Your first Exotic weapon in Destiny 2 may very well come from a random drop, but if you don't get lucky early on, thankfully you'll get your hands on one just by playing through the game's storyline.
After finishing the "Sacrilege" mission towards the end of the game's main campaign, The Red War, return to Asher Mir on Io and he will present you with a choice of three shiny new Exotic weapons. If you played the beta, two of them should be familiar to you.
This Void pulse rifle might be one of the sexiest new Exotics in Destiny 2. Killing an enemy with the final round if its bursts will suck it into a blackhole that explodes. It's really awesome to see. It is an Energy weapon, so it fits into your second slot.
This SMG is reminiscent of the Zhalo Supercell from Destiny 1, in that it has the Superconductor trait. This trait amplifies the gun's intrinsic perk, Arc Conductor, and shots fired by the gun have the chance to become chain lightning and return ammo. If you trigger the two perks correctly, you can fire continuously while the gun chains lightning to multiple enemies. It's bad-ass.
This handcannon fires explosive rounds that highlights the targets that it hits, but the most useful ability that it has is its trait, called Sun Blast. With Sun Blast, every enemy that is killed with Sunshot explodes in Solar energy, damaging other enemies nearby.
Which one should you pick? Basically, it depends on what kind of player you are. All three of these guns are great for PvE, but there are better options for PvP. If you want to take one of them into the Crucible, though, we suggest Sunshot.
All of these weapons are great for crowd control, but if you want one strictly for PvE purposes, the Riskrunner is the way to go. If you use it against enemies who are damaging you with Arc weapons, like most Fallen, you can continuously fire an endless stream of bullets.
It could come down to preference, though. If you're partial to submachine guns, pulse rifles, or handcannons, then the choice may be clear. But in the end you can't go wrong with Riskrunner.