In the first step UE sends Attach Request (Initial; with IMSI not GUTI) and in this message UE requests to connect to predefined APN, lets say this is the default APN.
1st question: Yes, the UE sends the APN name within the Attach Req.
Now, during the Update Location procedure MME requests for Subscriber Profile from the HSS, and if in the Subscriber Profile the APN requested by UE is not listed in the list of allowed APNs the Attach will be rejected with Missing or Unknown APN.
2nd question: From Subscriber's Profile it fetches from HSS during the Location Update procedure.
If there is no APN in Attach Request message, MME uses the APN marked as default in Subscribers Profile fetched from HSS.
*NOTE:* The initially connected APN for a UE does not have to be the marked default APN in the subscriber’s profile.
Even when the requested APN is not the one marked as default in Subscribers Profile but it is listed the scenario is valid and session will be established (with APN marked as default).
More about attach procedure you can find on my blog