312-49 Question #556: Real Exam Question with Answer & Explanation

The correct answer is C: NTFS has lower cluster size space. Slack space is the unused space between the end of a file's actual data and the end of the cluster allocated to it. NTFS uses smaller default cluster sizes (e.g., 4 KB) than FAT (which can use cluster sizes up to 32 KB or larger depending on volume size). Smaller clusters leave l

Submitted by carlos_mx· Apr 18, 2026Disk Forensics

Question

NTFS has reduced slack space than FAT, thus having lesser potential to hide data in the slack space. This is because:

Options

AFAT does not index files
BNTFS is a journaling file system
CNTFS has lower cluster size space
DFAT is an older and inefficient file system

Explanation

Slack space is the unused space between the end of a file's actual data and the end of the cluster allocated to it. NTFS uses smaller default cluster sizes (e.g., 4 KB) than FAT (which can use cluster sizes up to 32 KB or larger depending on volume size). Smaller clusters leave less wasted space per file, so there is less slack space available to hide data. The smaller cluster size is the direct technical reason for reduced slack space in NTFS.

Topics

#File Systems#NTFS#FAT#Slack Space

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice Browse All 312-49 Questions