Your Data Access Layer
can use an ORM
tool (like Hibernate (Java), NHibernate (.Net)) to do the database access. No problem with this. You could abstract the funcionalities into a model layer and implement it on your DAL project, for sample:
public interface ICustomerPersistence
{
Customer Get(int id);
bool Save(Customer customer);
}
and implement it using an ORM or another way to access the database (ADO.NET or JDBC).
Using an ORM tool, you will have a internal layer between your application and database. On the other hand, an ORM tool can provide to you and your team some productivity persisting objects instead writing SQL queries. On both cases, the SQL must be clean to provide performance. With ORM tools, probably you will need a trace tool to see the SQL commands generated by the ORM. For NHibernate, there is a NHProf.
For the second question, depende how you must implement. Most implementations of ORM like Hibernate/NHibernate do the control of the ISession object from an up layer from the DAL. For sample, as a good pratice in web applications, the ISession is open in the begin request and closed into end request. Sometimes it is also done by the Transaction.