It has to be a C-7. The C-5 and earlier cannot do S2 inclusion.
All this assumes a C7 hub...
Some devices, notably security devices like garage doors and locks must be paired securely with either S0 or S2.
It is best if you can pair all other devices (light switches, sensors, etc) without security, it isn't necessary and adds overhead to the Z-wave mesh.
You cannot change security after the fact, it must be done upon inclusion. The only way to change security is to exclude and re-include the device.
Security levels and other things can be found in the Settings tab, Z-wave details.
To address this specific question (you've got good advice above), this depends on two things. One is the specific "type" of S2: unauthenticated, authenticated, or access control. Only the first does not require any input from you during pairing, just confirmation that the DSK matches the device you're actually pairing (this might actually just be hidden in the new pairing UI; I can't remember, but it used to be displayed and may still be). The others require manual entry of the first part of the key.
The second is how you're doing the inclusion. The above assumes "traditional" pairing. You can also do SmartStart, which requires scanning the QR code (or manually entering the entire DSK), and then everything will happen automatically. I don't like this option, probably because I'm a control freak, I like to see what's going on, and I don't want to use a mobile app unless I have to. But it's an option.