Where should an ES search head be installed?

To observe what network services are in use in a network's activity overall, which of the following dashboards in Enterprise Security will contain the most relevant data?

After installing Enterprise Security, the distributed configuration management tool can be used to create which app to configure indexers?

Following the Installation of ES, an admin configured Leers with the ess_user role the ability to close notable events. How would the admin restrict these users from being able to change the status of Resolved notable events to closed?

An administrator is asked to configure an "Nslookup" adaptive response action, so that it appears as a selectable option in the notable event's action menu when an analyst is working in the Incident Review dashboard.
What steps would the administrator take to configure this option?