security best practice questions?

When is it appropriate to assign a custom domain user to your IIS application pool?


When is it appropriate to use asp.net impersonation to instead?


What are the pros/cons of each methodolgy?


thanks








...