Dear Tom,
I could not find a document explaining my complicated situation:
I have queried passwordfile locations gathered from V$PASSWORDFILE_INFO and by srvctl, then results are different on active dataguard such that:

On active dataguard: results of those two queries are different:

$ srvctl config database -d prodxxx1 | grep Password
Password file: +DATAC1/PRODXXXTDG/orapwprodxxx1

SQL> select * from V$PASSWORDFILE_INFO

FILE_NAME FORMAT IS_AS CON_ID
------------------------------------------------------------ ------ ----- ----------
/u01/app/oracle/product/12.2.0.1/dbhome_1/dbs/orapwprodxxx1 12 TRUE 0


On primary DB, both queries bring same result:

SQL> select * from V$PASSWORDFILE_INFO

FILE_NAME FORMAT IS_AS CON_ID
------------------------------------------------------------ ------ ----- ----------
+DATAC1/PRODXXX/PASSWORD/pwdprodxxx.273.1065533491 12 TRUE 0

$ srvctl config database -d prodmng | grep Password
Password file: +DATAC1/PRODXXX/PASSWORD/pwdprodxxx.273.1065533491

So, which location of password file on DG is correct? Which of them should I replace after change of SYS password?

Thanks in advance,
Selami