A CAPTCHA can be added to virtually each Drupal form. Some default forms are already provided in the form list, but arbitrary forms can be easily added and managed when the option Add CAPTCHA administration links to forms is enabled.
Users with the Skip CAPTCHA permission won't be offered a challenge. Be sure to grant this permission to the trusted users (e.g. site administrators). If you want to test a protected form, be sure to do it as a user without the Skip CAPTCHA permission (e.g. as anonymous user).