I agree, an educated guess will get you more points. Most attendings don't like to hear "I don't know" even if they tell you that they prefer you to say "I don't know". An educated guess helps show off your thought process. It's part of the art of pimping, or responding to pimping. It can involve anything from re-directing the pimping question to a subject that you are more familiar with, responding to the question with a more complicated question, stating facts about the subject that don't answer the question to bluffing (guessing an answer to the question while speaking in a confident, authoritive tone). There was a wonderful article linked here on SDN on pimping that was written half-jokingly, but it really accurately described how students/residents should handle pimping IMO.
If the attending question is regarding patient information that the attending needs to know (ie the information needs to be accurate, like what a lab value was or what an x-ray showed), and I'm not entirely sure, I will usually make a guess based on what I think I know and preface it with "I'm not sure, but I think...". I have found that if an attending needs an exact answer right away, he or she will ask me to look it up. If not, and I look it up later and realize that I was incorrect, I will go back and correct the misinformation that I gave the attending. I do not advocate making "wild" or random guesses regarding patient information though (eg telling the attending that the potassium was normal and chest x-ray was clear when you never looked at either), as that can lead to medical mismanagement. If you vaguely recall seeing the information before but are not 100% sure about it, I think that it is acceptable to admit that you are not sure but relay what you vaguely recall in my opinion. What you vaguely recall can be useful in your team's management sometimes.