Posting in the Magento forums has been disabled pending the implementation of a new and improved forum solution which should better serve the community.
For new questions please post at magento.stackexchange.com, the community-run support site for the Magento community. We will be providing updates on the new forum solution soon. For questions or concerns please email firstname.lastname@example.org.
how to prevent web access of /app/etc/local.xml file?
Yes, IIS doesn’t listen to .htaccess files. You need to block the file using the IIS URL rewrite module (available from www.iis.net), or through IIS request filtering...the former being the best solution. I am in the process of writing an article on the proper way to go about installing Magento on IIS 7/7.5 as well as properly securing it. I’ll post the article on this sight soon!