Exercise 3: How an Unencrypted Backup Undermines FileVault — Possible Solution
====================================================================

HOW IT UNDERMINES FILEVAULT DESPITE FILEVAULT WORKING CORRECTLY
------------------------------
Per this chapter, FileVault correctly encrypts the original startup disk, but a Time Machine backup is a complete copy of that disk's data written to a separate physical drive. If that backup drive itself is left unencrypted, it now holds an unencrypted copy of everything FileVault was protecting on the original disk. FileVault's own protection on the original disk is unaffected and still works exactly as intended - the problem is that a second, unprotected copy of the same data now exists somewhere else entirely. A lost or stolen unencrypted backup drive would expose all of that data just as completely as if FileVault had never been turned on at all, because the protection never traveled with the data to its backup copy.

THE FIX
------------------------------
Per this chapter, Time Machine offers to encrypt its backup disk when a backup destination is first set up - accepting that offer is the fix, ensuring the backup copy is protected by its own encryption rather than relying on the original disk's FileVault protection to somehow extend to a separate physical drive it has no relationship to.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly explains that the vulnerability isn't a flaw in FileVault itself but a consequence of an unprotected duplicate copy existing on separate media, and correctly identifies enabling Time Machine's own backup-disk encryption option as the actual fix.