ASP.NET protects configuration files (Machine.config & Web.config) from outside access by configuring Internet Information Services (IIS) to prevent direct browser access to them.
HTTP access error 403 (forbidden) is returned to any browser attempting to request a configuration file directly.