Option D. GOST R 50739-95 (2 passes) is the best answer because the question specifically describes a sanitization method that writes zeros on the first pass and random bytes on the second pass . Among the listed choices, that pattern matches the 2-pass GOST method . CHFI v11 includes sanitize the target media under rules and procedures related to evidence handling, showing that candidates are expected to understand how media sanitization supports secure handling of sensitive storage devices and prevents residual data exposure.

This question is focused on the operational detail of a wiping standard. The other options involve more passes and therefore do not match the exact requirement stated. NAVSO P-5239-26 (MFM) and NAVSO P-5239-26 (RLL) are 3-pass methods, while VSITR is a 7-pass method. Since the scenario emphasizes first zeros, then random bytes , and wants the correct standard associated with that sequence, GOST R 50739-95 is the only option that fits.

From a CHFI perspective, sanitization matters because investigators and security teams must know how to prepare or dispose of media securely while protecting evidence integrity and sensitive data.