XProtect is Apple’s built-in antivirus technology for macOS. It performs signature-based malware detection using YARA signatures, making option C correct. Apple monitors emerging malware and regularly updates XProtect signatures automatically and independently of normal macOS operating-system updates. XProtect can check applications when they are first launched, when an application changes in the file system, and when new XProtect signatures are installed. It can block known malicious software and also includes technology for remediating malware that has already executed. XProtect does not depend on third-party endpoint applications or a device management service to supply its malware signatures. Although notarization and Gatekeeper work alongside XProtect as parts of macOS malware protection, XProtect is not based solely on notarization hashes distributed through CloudKit.

================