200-201 Host-Based Analysis Practice Question
A security analyst is examining a Linux web server that is suspected of being compromised. The analyst runs `ps aux` and notices a process named `apache2` running as the user `www-data`, but its parent process ID (PPID) is 1 (init/systemd). Normally, `apache2` is started by a master process. What is the most likely explanation for this anomaly?
⚠ Common exam trap
The trap here is assuming that systemd directly starts Apache workers, when in reality a master process typically manages them, so PPID 1 suggests an orphaned process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The `apache2` process was re-parented to init after its original parent terminated.
On Linux, when a parent process dies, its children are re-parented to PID 1 (init/systemd). An `apache2` worker with PPID 1 indicates its original parent (the Apache master) is no longer running, which is unusual and may indicate tampering or a crash. This warrants further investigation into process lineage and system logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The `apache2` process was re-parented to init after its original parent terminated.
Why this is correct
When a process's parent terminates, the child is re-parented to PID 1 (init or systemd) on Linux. This can happen if the original Apache master process crashed or was killed, leaving orphaned worker processes. An attacker might also kill the parent to hide the lineage. Thus, PPID 1 for `apache2` suggests the original parent is gone, which is suspicious.
- ✗
The `apache2` process is a kernel thread masquerading as a user process.
Why it's wrong here
Kernel threads typically have names in brackets (e.g., `[kworker]`) and run with PPID 2 (kthreadd) on many systems, not PID 1. They also do not run as `www-data`. A user-space process like `apache2` running as `www-data` is not a kernel thread. This explanation is technically incorrect.
- ✗
The `apache2` process was started by systemd as a direct child of PID 1.
Why it's wrong here
Systemd (PID 1) can start services directly, but Apache is typically started via a master process that forks workers. If systemd started Apache, the master process would be the child of systemd, and workers would be children of the master. Seeing a worker with PPID 1 implies the master is missing, which is abnormal. This option incorrectly assumes normal systemd behavior.
- ✗
The `apache2` process was started by a cron job.
Why it's wrong here
Cron jobs are typically spawned by `crond` or `systemd`, not directly by PID 1 unless the cron daemon itself is PID 1. In most Linux distributions, `cron` runs as a separate daemon. A cron-spawned process would usually have `crond` as its parent, not PID 1. Therefore, this does not explain the PPID 1 anomaly.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.