It depends, you can pick it. It can range from a simple 4 digit numeric PIN to a full blown alphanumeric with symbols password text field. But I guess the most common is that grid gesture thing, which in some phones you can also customise the size of the grid itself. All these options work as the default fallback to biometrics.

As far as I know as well, you are required to input your pin/password/gesture after a long period of inactivity, after X days, and after a reboot, before being able to use biometrics again.