If I don't know the answer to a question or if it is ambiguious, I tell them. For example, I was once asked to describe how a TCP sessions ends. Well, that's implementation defined. What OS? Are we talking FIN ACKs or do TCP resets count as ending a session too? The RFC may say this, but in the real-world, software sometimes does it like that. Etc, etc.
And, many times the questions aren't made to be answered, but to draw things out of you (like the one above). And in these cases, you can turn the questions back on them. Put them on the answering end ;) and that's OK, those exchanges tell both sides a lot about the other.
I do like a few black and white questions. Like, "How many bits are in an IPv4 address" or "What data structure is a C++ set typically implemented in" and if candidates have no idea on an answer, then I do have concern over that. However, if they do not know the answer, but understand types and their sizes and data structures and their pros/cons, then that's good enough in some cases as well.