Base configuration settings for machine.
C:\WinNT\Microsoft.NET\Framework\v.1.00\config\machine.config

Overridden by the configuration settings for the site (or the root application).
C:\inetpub\wwwroot\web.config

Overridden by application configuration settings.
D:\MyApplication\web.config

Overridden by subdirectory configuration settings.
D:\MyApplication\MyDir\web.config

<configuration>
    <!- Configuration settings would go here. -->
</configuration>

<configuration>

  <configSections>
    <sectionGroup name="system.web">
      <section
        name="httpModules"
        type="System.Web.Configuration.HttpModulesConfigurationHandler,System.Web"
      />
    </sectionGroup>
  </configSections>

  <system.web>
    <httpModules>
      <add
        name="CookielessSession"
        type="System.Web.SessionState.CookielessSessionModule,System.Web"
      />
      <add
        name="OutputCache"
        type="System.Web.Caching.OutputCacheModule,System.Web"
      />
      <add
        name="Session"
        type="System.Web.SessionState.SessionStateModule,System.Web"
      />
      <add
        name="WindowsAuthentication"
        type="System.Web.Security.WindowsAuthenticationModule,System.Web"
      />
      <add
        name="FormsAuthentication"
        type="System.Web.Security.FormsAuthenticationModule,System.Web"
      />
      <add
        name="PassportAuthentication"
        type="System.Web.Security.PassportAuthenticationModule,System.Web"
      />
      <add
        name="UrlAuthorization"
        type="System.Web.Security.UrlAuthorizationModule,System.Web"
      />
      <add
        name="FileAuthorization"
        type="System.Web.Security.FileAuthorizationModule,System.Web"
      />
    </httpModules>
  </system.web>

</configuration>