Yes

Yes

u/MeCJay12 summarized things well.

You have to supply a passphrase, PSK, token, or 2FA to decrypt.

Consider full disk encryption as a large container covering the entire block device (HDD / SSD, etc). Inside the encrypted container is a filesystem which contains links to the locations of data (files) on the device. Veracrypt operates silently in the background. Once you supply correct authentication, the filesystem becomes visible to the kernel, is autodetected, and can be mounted.