Why can I still access my ASP.NET pages even though I disabled anonymous access to my directory?

After disabling anonymous access using the IIS 7 Manager, ASP.net pages are still accessible without getting prompted with authentication.  

In order to force ASP.net to take NTFS permission into consideration, the authentication mode in the web.config file must be set to Windows.