Very theoretical question, how secure is the mentioned configuration? (IIS7.5 and Windows 2008 R2). I don't mean things like easy passwords, open ports and unsecured c#/.net code.
I mean, are there any serious holes/hacks which ignore any user settings and that attacker is able to gain access to server?
Is it much more secure than IIS6 and Windows Server 2003 used to be? Would you put it online without putting firewall before it? (update: I mean linux/unix/hw firewall in front of windows machine. Windows firewall has to be always on)