Comprehensive and Detailed Step-by-Step Explanation:
Normalizationis the process ofstructuring log datainto a standard format for easy analysis and correlation across multiple systems.
* Normalization (Correct Answer - D)
* Ensures consistency in log file formats.
* Helps security analysts detect patterns and anomalies.
* Example:Converting log timestamps into a standardized format (UTC).
* Extraction (Incorrect - A)
* Retrieves data but does not format it for analysis.
* Data Acquisition (Incorrect - B)
* Refers to collecting data, not structuring it.
* Imaging (Incorrect - C)
* Creates copies of disk storage but is unrelated to log analysis.
References:
* ISACA CISA Review Manual
* NIST 800-92 (Guide to Computer Security Log Management)

Deep packet inspection (DPI) is a core capability of data loss prevention (DLP) tools that allows the analysis of the content of data packets in transit. This helps detect the unauthorized movement of sensitive data by examining packet-level details.
* Network Traffic Logs (Option A):These provide historical data but do not actively detect data in transit.
* Data Inventory (Option C):Useful for identifying where sensitive data resides but not for monitoring its movement.
* Proprietary Encryption (Option D):Protects data but does not detect unauthorized transmission.
Reference:ISACA CISA Review Manual, Job Practice Area 4: Protection of Information Assets.