CHFI Storage Forensics and File System Analysis Practice Question
Which THREE of the following are characteristics of the GPT (GUID Partition Table) compared to MBR?
⚠ Common exam trap
The CHFI exam often tests the misconception that GPT stores partition data in the boot code area (like MBR's partition table), but in reality, the boot code area in GPT is only a protective MBR with a single partition entry for backward compatibility.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Partitions are identified by a Globally Unique Identifier (GUID)
Option C is correct because GPT identifies each partition and partition type with a Globally Unique Identifier (GUID), which avoids the MBR's reliance on simple numeric type bytes and enables robust, unique identification. Option D is correct because GPT by default provides space for 128 primary partitions in its partition entry array, unlike MBR's four-primary-partition limit. Option E is correct because GPT writes a primary partition table near the beginning of the disk and a backup copy at the end of the disk, allowing recovery if the primary table is damaged. Option A is incorrect because GPT stores partition information in the GPT header and partition entry array, not in the boot code area; that description better fits MBR, where the partition table resides in the master boot record. Option B is incorrect because GPT uses 64-bit Logical Block Addressing (LBA), whereas MBR uses 32-bit LBA fields.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Partition information is stored in the boot code area
Why it's wrong here
This is incorrect. In GPT, partition information is not stored in a boot code area. The drive begins with a protective MBR (LBA 0) that allows legacy BIOS tools to see the disk as a single, unpartitioned device, but the actual GPT header resides at LBA 1 and the partition entry array begins at LBA 2. The concept of a boot code area derives from the classic MBR layout, which uses a 446-byte boot code region; GPT does not overlay its partition table there.
- ✗
Uses a 32-bit Logical Block Address (LBA)
Why it's wrong here
This is incorrect because GPT relies on 64-bit Logical Block Addresses, not 32-bit. A 64-bit LBA scheme allows GPT to address disks up to 9.4 zettabytes (2^64 sectors), far surpassing the 2 TiB limit imposed by the 32-bit LBA used in traditional MBR partitioning. This 64-bit addressing is fundamental to modern large-capacity drives and is a defining difference between GPT and MBR.
- ✓
Partitions are identified by a Globally Unique Identifier (GUID)
Why this is correct
This is correct. Every GPT partition is assigned a Globally Unique Identifier (GUID) that serves as the partition's unique identity, in addition to a separate GUID for the partition type. These GUIDs are randomly generated and statistically unique, enabling robust identification that does not rely on disk order or numbering. The GPT header itself also has a GUID for the disk, making the entire layout disklabel-oriented rather than sector-offset-oriented.
- ✓
Supports up to 128 primary partitions
Why this is correct
This is correct. GPT supports up to 128 primary partitions by default, a huge leap from the MBR's limit of 4 primary partitions. This is achieved because the GPT partition entry array is a large table (typically 16 KB in Windows deployments), with each entry being 128 bytes, yielding 128 entries. Unlike MBR, GPT does not need extended or logical partitions; all 128 entries are treated as primary partitions.
- ✓
Stores a backup partition table at the end of the disk
Why this is correct
This is correct. GPT maintains two copies of its structure: the primary GPT header and partition entry array at the beginning of the disk (LBA 1 onward), and a backup GPT header and partition entry array at the very end of the disk. This redundancy allows recovery if the primary table is corrupted, and the backup header also stores a CRC32 checksum to validate integrity. That backup location is a critical resilience feature not present in MBR.
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.