Right.

Organization-Wide Sharing Defaults are used to set the default level of access for users to records that they do not own.

Link to Salesforce Help : Defaults Organization-Wide Access Levels

Right.

You indeed need an approval process (Setup > Quick Search > Approval Processes).

Link to Salesforce help : Set Up an Approval Process

Right.

Duplicates can be blocked or allowed, when a record is created or edited. There can be multiple active duplicate rules, and they can be used for Accounts, Contacts, Leads and Individuals objects.

Right.

A formula field can contain up to 3900 characters.

Link to Salesforce Help : Formula field limits

Right.

Roll-up summary fields are only available for master-detail relationships. In a master-detail relationship, you can’t have a child record without a parent (it’s possible in a look-up relationship), and you can have up to 2 master-details on an object.

Right.

Verify Identity, Reset Password and Create a Case (to handle missing credentials issues) Flows are prebuilt Flows that come with an org.

Right.

In this case you can just use standard fiscal year and select march as start month. You don’t need custom fiscal year when the business year of the company follows the gregorian calendar (12 months calendar).

Link to Salesforce help : Fiscal Year

Right.

WhatId is mainly used for relating to Account, Case, Opportunity and Campaign (it refers to “object” entities). WhoId is used for relating to Lead and Contact (it refers to “people” entities).

Link to Salesforce Help : WhatId and WhoId

Right.

A good way to help sales rep to have access to relevant informations is to enable the News feature (Setup > Account Settings > Enable News).

Right.

To display a single value, a Metric component is the way to go.

Link to Salesforce Help : Dashboard Component Types