In ASP.NET configuration, ? represents anonymous users, and * represents all users. The element explicitly prevents anonymous users from accessing the application, while allowing authenticated users. Distractors like explicitly allow anonymous access, and `` denies everyone.