Explanation
The statement is correct. In the provided Docker Compose file, a health check is defined for the service "app".
It uses curl to perform a health check on the application every 10 seconds (as specified by the "interval" parameter). If it fails three times (as specified by the "retries" parameter), then the container is marked as unhealthy. A health check is a way of checking the health of a running container and applying actions based on the result1. It can be used to monitor the status of the service and restart the container if it becomes unhealthy2. References:
* Compose file version 3 reference | Docker Docs
* Docker Compose & Health Checks - Gabriel's World

Explanation
This does not describe the role of Control Groups (cgroups) when used with a Docker container, because role-based access control to clustered resources is not related to cgroups. According to the official documentation, cgroups are a Linux kernel feature that limits and isolates the resource usage of a group of processes, such as CPU, memory, disk I/O, network, etc. Docker can use cgroups to share available hardware resources to containers and optionally enforce limits and constraints.
References: https://docs.docker.com/config/containers/runmetrics/
https://bikramat.medium.com/namespace-vs-cgroup-60c832c6b8c8

Explanation
This command will not ensure that overlay traffic between service tasks is encrypted, because it uses an invalid option for enabling encryption and an incomplete option for specifying the network. According to the official documentation, there is no such option as --secure for the docker service create command. The correct option to use is --network <network-name> where <network-name> is an existing overlay network that was created with encryption enabled.
References: https://docs.docker.com/network/drivers/overlay/#encryption
https://docs.docker.com/engine/reference/commandline/service_create/

Explanation
The networkPolicy will block this traffic. A networkPolicy is a Kubernetes resource that defines how pods are allowed to communicate with each other and with other network endpoints. A networkPolicy has two main sections: podSelector and policyTypes. The podSelector selects which pods the networkPolicy applies to. The policyTypes specifies whether the networkPolicy affects ingress (incoming) traffic, egress (outgoing) traffic, or both. In this case, the networkPolicy applies to pods that have a label app: webserver and affects both ingress and egress traffic. The networkPolicy also has two optional sections: ingress and egress. The ingress section defines the rules for allowing ingress traffic to the selected pods. The egress section defines the rules for allowing egress traffic from the selected pods. If either section is missing or empty, it means that no traffic of that type is allowed. In this case, the networkPolicy has an empty ingress section, which means that no ingress traffic is allowed to the pods that have a label app: webserver. Therefore, a request issued from a pod bearing the tier: backend label, to a pod bearing the tier: frontend label will be blocked by this networkPolicy, since it is an ingress traffic to a pod that has a label app: webserver. References:
https://kubernetes.io/docs/concepts/services-networking/network-policies/,
https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#networkpolicy-v1-networking-k8s-io