When you block requests to Application.cfc (for instance) in IIS, how do you do it? Listing it as a Deny sequence gives this error in the browser:

HTTP Error 404.5 - Not Found
The request filtering module is configured to deny the URL sequence.

That doesn't seem ideal. I could do that, and also add a custom error page for it, but it seems like I'm implementing this in more layers than may be necessary. Anyone have any insight on better ideas or common practices?