Or simply use the .config extension for the file, because IIS will not serve these types of files for client requests.