A security team requires organization-wide centralized logs, while workload teams must not be able to erase the retained evidence. Which two controls are appropriate? Select 2 answers.

1. Grant every workload administrator unrestricted deletion of the central archive.
2. Store logs in a separately administered account with restricted destructive permissions.
3. Make the logs public so any loss can be noticed by outside users.
4. Apply suitable object retention or Object Lock controls for the required evidence period.
5. Use only encryption at rest as proof that deletion is impossible.