Explanation:

According to the official Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn documentation on "Implement and manage self-service password reset (SSPR)", configuration of SSPR requires settings in both Azure AD and Azure AD Connect.
* Azure AD Configuration (Password reset blade):In the Azure AD admin center, the Password reset blade includes three primary sections: Properties, Authentication methods, and Registration.
* The Authentication methods section determines which verification methods users can use when resetting their password.
* To meet the requirement that users must respond to a mobile app notification or answer three security questions, you must configure these under Authentication methods.Microsoft documentation explicitly states:
"In the Authentication methods section of the Password reset settings, choose which methods users can use, such as mobile app notification, email, or security questions."
* Azure AD Connect Configuration:When users reset their password in Azure AD or on-premises, synchronization must occur both ways to ensure passwords remain consistent.
* Enabling Password writeback in Azure AD Connect allows password changes made in Azure AD (such as through SSPR) to be written back to the on-premises Active Directory.The study guide confirms:
"Password writeback enables users who change or reset their password in Azure AD to have that new password written back to their on-premises Active Directory." Therefore, to meet both requirements - user verification via mobile app or security questions and password synchronization between cloud and on-premises - the correct configuration is:
* From the Password reset blade: Authentication methods
* From Azure AD Connect: Password writeback