Many IIS servers connect to Microsoft SQL databases. Which of the following statements about SQL server security is TRUE?

SQL Server patches are released independently through Microsoft's SQL Server update channels and are not included in standard OS patch cycles.

Placing IIS and SQL Server on the same host violates service separation principles and expands the attack surface - a compromise of the web tier can directly expose the database.

Integrated Windows authentication for SQL Server is generally more secure than SQL authentication because it uses Kerberos or NTLM and avoids storing database passwords in connection strings.

Allowing users to pass raw SQL directly to SQL Server enables SQL injection attacks, where malicious input can manipulate queries to expose, alter, or destroy data. Best practice is to use parameterized queries or stored procedures to sanitize input and prevent user-controlled strings from being interpreted as SQL code.