I don't believe there is a way to enable root guard globally. At the interface level it is enabled with spanning-tree guard root. Are you instead asking about bpdu filter or bpdu guard?
If one of these is what you are asking about, than it would depend on whether the port is configured for portfast or not. If the access port is configured with portfast or the trunk port is configured with portfast trunk, than yes both would be configured with bpdu guard or bpdu filter if globally enabled.as the default. If the port is not configured as a portfast port it will not be enabled though.
If you are talking about root guard, it is enabled at the port level and can be configured on either access, trunk, or portfast ports.
For your second question again it depends on what spanning tree feature you are talking about.
If you are talking about root guard, you would enable it on the port from SW1 to SW2 and the port from SW1 to SW3. This is all based on your design though. If your design calls for root bridge redundancy or security, then you will have to place root guard on whatever ports are facing away from the expected location of any possible root bridge, or at your network trust boundary. You can also enable it on all other ports not expected to become root, such as those towards end hosts and devices not participating in STP.
If you are talking about bpdu guard, you would normally only enable it on interfaces connecting to end hosts or other devices that do not participate in STP.
If you are talking about bpdu filter it is a little bit different, it depends on whether you configure it globally or at the port level. If you enable it at the port level, you would normally configure this to partition the STP domain. You would configure it on the two ports (or one) on the segment that you would like to partition. It effectively turns off STP on the interface, neither sending or processing BPDUs. If you enable it globally, you would normally do this for ports that are not expected to receive BPDUs and participate in STP. At port up, the port sends 11 BPDUs and if a BPDU is received it would transition to a normal STP port and participate in STP. If a BPDU is not received in response within this time frame, the port stops sending and processing BPDUs again effectively turning STP off. This is normally used in an environment where the device connected is unknown and may be a device that will participate in STP, or may be an end host that will not. You have to be careful configuring bpdu filter as it effectively disables STP and you can create switching loops if you have any physical loops in the network.
Hope this explains everything and is what you are looking for.
