IIS7 newbie question on a mix of configuration, delegation, allowDefinition locations

a newbie question on configuration locations, for example on applicationpools, on default the allowDefinition is set at AppHostOnly right

from applicationhost.config,

<configSections>
        <sectionGroup name="system.applicationHost">
            <section name="applicationPools" allowDefinition="AppHostOnly" overrideModeDefault="Deny" />

from an article on msdn it states applicationpools element can be declared in applicationhost.config only, http://msdn.microsoft.com/en-us/library/aa347554%28v=vs.90%29.aspx

"The applicationPools element can be declared in ApplicationHost.config only. Any attempt to declareapplicationPools in a configuration file at a different level in the hierarchy results in an error message."

but according to http://technet.microsoft.com/en-us/library/cc268239.aspx

"AppHostOnly The section can be set only in Web.config files for application root directories"

so i am confused, one said only configure in applicationhost.config only and one said can be set only in web.config files... which one is right?

so if applicationpools is can only be in applicationhost.config, why not set to machineonly by default?

and if it is set at everywhere (default), what elements can delegate to site or even virtualdirectory level? for example system.web/httpHandlers or system.net elements can be delegated to how far?