David works as a Software Developer for GenTech Inc. He creates an XML Web service, named MyWebService, using Visual Studio .NET. MyWebService uses Microsoft Windows authentication. Users of MyWebService are in the GenTech domain. David wants to configure MyWebService to use the following URL-based authorization rules:

l Anonymous users must not be allowed to access MyWebService.

l All the users except User1 and User2 must be allowed to access MyWebService.

David configures Internet Information Services (IIS) to meet these requirements. Which of the following code will David use to configure the authorization section of the Web.config file for MyWebService?