A cloud engineer is enabling NSG flow logs for subscription 'prod-sub' and must choose a storage account and retention policy. Which TWO of the following statements about NSG flow logs and storage/retention are correct? (Select TWO)

NSG flow logs are indeed written to an Azure Storage account, and you must specify this account during the enablement process for Network Watcher, making the first option correct. The storage account must be in the same subscription as the NSG, but can reside in any region. It's crucial that Network Watcher is enabled in the region where the NSG exists to capture logs, confirming the fourth option. The second option is incorrect because general-purpose v2 (GPv2) storage accounts are fully supported and recommended. The third option is incorrect because setting retention to 0 days means logs are not retained at all, not indefinitely. The fifth option is incorrect as storage accounts do have retention settings, and indefinite retention is possible directly through storage account lifecycle management.