The server is configured to use pass-through authentication [you can verify this by selecting the site, choosing basic settings -> Connect as… -> {and you should see Application User (pass-through authentication) is set}].
The built in account is set on the app pool’s settings. The error message is telling you that the account on the app pool can’t access the folder set on the activated application. The normal group you need to put onto a folder is IIS_USERS with Read, List, Read & Execute. IIS timed out because it couldn’t initialize the site to load because the OS won’t let it touch the files to see what it should load for the request. You might wonder why you didn’t get a 401, but its because IIS can’t get far enough to actually start giving you any sort of status on your requests.