not allow OPTIONS, TRACE with asp.net

 <system.webServer>
  <security>
   <requestFiltering>
    <verbs allowUnlisted="true">
     <add verb="OPTIONS" allowed="false" />
     <add verb="TRACE" allowed="false" />
    </verbs>
   </requestFiltering>
  </security>
 </system.webServer>