Applying the principle directly: a master answers to outsiders for whatever his servant does within the scope of the job the servant was hired to do. Y's job was exactly to receive material and issue receipts on X's behalf, so the receipt Y gave to Z for the cement is treated as X's own act, regardless of what Y later did with the goods.
The principle of vicarious liability therefore places the full obligation on X, making X is liable for the entire amount the most reasonable conclusion.
Another way to read the principle is through the reason it exists: it places the risk of a servant's dishonesty on whichever party chose to trust that servant with the job, not on an outside party who dealt with the servant in good faith. X chose to appoint Y as property in-charge and gave him the authority to receive material and issue receipts, so X, not Z, is the one who put Y in a position to misuse the goods.
Placing the risk on X, the party who appointed and trusted Y, rather than on Z, the outside supplier who relied on the receipt, is what the principle is meant to achieve.
Therefore, the correct answer is X is liable for the entire amount.