What if Some one types the URL of web.config file in the browser?

Answer:

ASP.NET configures IIS to prevent direct browser access to web.config files to ensure that their value can not become public. Attempt to access web.config file will cause ASP.NET to return 403: Access forbidden error.