I was able to secure the subdomain by creating a separate web.config file residing in the web root of the subdomain (which physically exists as a subdirectory within the root domain). I assume this solution would work for subdomains as well as basic subdirectories of a domain.
Within the web.config file I added the following. I've removed the extraneous/unrelated directives removed for clarity but wanted to show the full xml structure of the web.config file:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<security>
<authentication>
<anonymousAuthentication enabled="false" />
<basicAuthentication enabled="true" />
</authentication>
</security>
</system.webServer>
</configuration>
The important part was adding the two authentication directives within the authentication section (which resides within configuration > system.webServer > security).
Note that this method requires me to use my main "server" login provided by the hosting service, and I was not able to manually specify a username and password to be used.
If you need to quickly secure a subdirectory or subdomain on an IIS7 server though, this should do the trick. I believe the credentials you'd need to use are the ones you use to access the FTP server, though I'm not sure if those are the same as the "hosting control panel" credentials for everyone or just for my host.