app.config-> contains application specific settings

web.config
Web.config is a security in ASP.Net application and how to 
secure applications. Web.config does most of the work for 
the application the who, what, where, when and how to be 
authenticated.
1.This is automatically created when you create an ASP.Net 
web application project.
2.This is also called application level configuration file.
3.This file inherits setting from the machine.config

Machine.config contains settings that apply to an entire 
computer. This file is located in the %runtime install path%
\Config directory. Machine.config contains configuration 
settings for machine-wide assembly binding, built-in 
remoting channels.
1.This is automatically installed when you install Visual 
Studio. Net.
2.This is also called machine level configuration file.
3.Only one machine.config file exists on a server.
4.This file is at the highest level in the configuration 
hierarchy.