Digitally signed third-party certificates provide greater security assurance because they are verified by trusted Certificate Authorities (CAs) and offer protection against on-path (man-in-the- middle) interception. Private-key Certificate Signing Request (CSR) signage helps ensure that communication cannot be intercepted or modified by malicious actors. Self-signed certificates, on the other hand, are not trusted outside the local environment and do not provide the same level of protection against on-path attacks.

The network administrator is noticing a web attack that attempts to access the /etc/shadow file on a Linux web server. The /etc/shadow file contains the encrypted passwords of all users on the system and is a common target for attackers. The attack uses a technique called directory traversal, which exploits a vulnerability in the web application that allows an attacker to access files or directories outside of the intended scope by manipulating the file path. Validating the server input and appending the input to the base directory path would be the best action for the network administrator to take to defend against this type of web attack, because it would:
Check the user input for any errors, malicious data, or unexpected values before processing it by the web application.
Prevent directory traversal by ensuring that the user input is always relative to the base directory path of the web application, and not absolute to the root directory of the web server. Deny access to any files or directories that are not part of the web application's scope or functionality.

To support the specific environment that handles sensitive data while remaining compliant with the security compliance requirement, it would be appropriate to implement a jump box in the screened subnet for privileged users.
A jump box is a secure server that is used as a central point of access to a restricted network. It is typically used to provide remote access to a screened subnet, which is a network segment that is isolated from the rest of the network and is only accessible through a jump box or other secure access point. By using a jump box, privileged users can access the environment and support it from their workstations while still maintaining need-to-know restrictions and only connecting to authorized endpoints.

Software composition analysis would have stopped this attack from occurring by validating the security of 3rd party libraries before incorporating into code.

Erasure is part of GDPR compliance. A citizen has the right to request their data be deleted.
Reference:
https://gdpr.eu/compliance-checklist-us-companies/
https://www.clouddirect.net/11-things-you-must-do-now-for-gdpr-compliance/