MetroBank needs to capture packets from a production VM (payment-vm) for a short troubleshooting window. Company policy forbids storing captures in a shared storage account outside the VM's subscription, and they prefer local VM storage for the capture, but size is limited. Which statement correctly describes Network Watcher packet capture storage options and trade-offs?

The correct option accurately describes Network Watcher's flexible storage options. Network Watcher packet capture can indeed store data directly to an Azure Storage account, which is ideal for larger captures and long-term retention. Alternatively, for scenarios like MetroBank's where data must remain within the VM's subscription and local storage is preferred, the packet capture VM extension can write to the VM's local disk. This local disk option is ephemeral and has size limitations, which aligns with the company's constraints and preferences for short troubleshooting windows. The first incorrect option is wrong because storing to VM local disk is supported via the extension. The third incorrect option is incorrect because packet capture does not stream directly to Log Analytics; it stores to storage accounts or local disk first. The fourth incorrect option is incorrect because Azure Files shares are not a direct storage target for Network Watcher packet captures; the primary options are storage accounts or local VM disk.