Briefly - 1) no 2) yes
& is an address retrieval statement. &app is the address of the argument passed to the function, i.e. the address of the memory cell in the stack where it will be put. You also need to pass the address of the line from which the information will be taken to sprintf . This address is contained in the app variable itself, so you must pass in its value, not its address.
Globally - when you need to write & - to answer unambiguously and simply will not work, if not limited to some particulars. Simplified like this - you just need to understand what is expected of you - some value, or indicate where this value is located.
On the second question - when passing an array to a function, its name is replaced with the address of the first element, so that you are passing everything correctly.