core.extension.yml is a YAML file listing all installed and enabled modules, themes, and profiles and their respective weight (if specified).
The correct way of declaring the sync directory in settings.php changed with Drupal 8.8.0 as follows:
Before:
$config_directories['sync'] = 'sites/default/files/config_YLZJmmpOqc_KBWbMc2I58ky3-8c7qtg4G-OpSqFClHs5E0NL9YMFgyF4RRTv8IFdl_kAMs_Bdw/sync';
After:
$settings['config_sync_directory'] = 'sites/default/files/config_YLZJmmpOqc_KBWbMc2I58ky3-8c7qtg4G-OpSqFClHs5E0NL9YMFgyF4RRTv8IFdl_kAMs_Bdw/sync';
See: https://www.drupal.org/node/3018145
In terms of location, it's generally considered to be more secure if it's below the webroot, e.g.:
$settings['config_sync_directory'] = '../config/sync';
Further reading: https://www.drupal.org/docs/configuration-management/changing-the-storage-location-of-the-sync-directory