Which feature contains scenarios that are useful during ES implementation?

A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives.
Which of the following options is most likely to help performance?

Which of the following are the default ports that must be configured for Splunk Enterprise Security to function?

When installing Enterprise Security, what should be done after installing the add-ons necessary for normalizing data?

What does the risk framework add to an object (user, server or other type) to indicate increased risk?