Understanding the attack on IIS virtual hosting

Understanding the attack on IIS virtual hosting

I'm reading https://drive.google.com/file/d/1aeNq_5wVwHRR1np1jIRQM1hocrgcZ6Qu/view?pli=1

On page 44 it mentions about a way to exploit IIS servers,

I tried to reproduce it but it didn’t work.

1. I created a Windows 2016 IIS server and add a virtual directory /test/ and placed a file in it, and I can access it via hxxp://127.0.0.1/test/ok.txt.
2. I created another file "bug/bug.txt" outside wwwroot folder.

But I can’t access bug.txt via hxxp://127.0.0.1/test/..%2fbug/bug.txt. Is there any special configuration necessary to reproduce this issue?