1) Yes, the advanced has CAPTCHA and it can be moved to the simple.
2) It isn't really required in either, it is just an option.
3) They can be changed with the spry and server validations. I believe it is at least six characters with one number by default, but that could be easily changed.