Where should an ES search head be installed?

A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance.
What is the best practice for installing ES?

Which of the following is a way to test for a property normalized data model?

Enterprise Security's dashboards primarily pull data from what type of knowledge object?

What feature of Enterprise Security downloads threat intelligence data from a web server?