4. Advanced : Exam Security
A look at the advanced and security options that can be configured on exams
Exam Security
In the advanced settings pages on an exam you'll find a range of additional configurations to add to exams to enhance exam security.
Synap includes a fully configurable online proctoring solution called Synoptic. Synoptic allows organisations to add security controls and monitoring to assessments, ranging from simple browser-based assessments through to high-security, lockdown examinations with continuous recording and live oversight.
For more information, see the Proctoring with Synoptic documentation.
Proctoring with SynopticAnti-Cheat featuresRestrict by IP
You can restrict your exams to a specific IP address, or a set of IP addresses using our IP restriction feature, which can be accessed from Exams > Advanced > Security > Restrict by IP.
IP restriction will mean that candidates can only enter the exam if they are accessing from a particular location that you have specified. This can be helpful if, for example you are running a test in a physical test centre, or if you need to ensure that your exam cannot be accessed in certain countries/regions.
When you enable this section, a box will appear which you can use to enter IPs which you want to allow. You should type in 1x IP address per line.
The box will accept any valid IPv4 or IPv6 address, as well as CIDR ranges.
When enabling this feature, there are a few things you may want to bear in mind:
Most people's home networks will use dynamic IPs, this means that their IP address will change periodically. For this reason, if you are conducting a remote exam to be taken from candidate's own homes/devices, this option is probably not suitable for you
If your users are using VPNs, then this may affect the IP that they are connecting from
We strongly recommend testing this feature out, by assigning an exam to your internal team or admins, prior to launching it with real students. Whilst the feature itself is very simple to set up, if the IPs are not set-up correctly, or if there are unexpected proxies/VPNs in-use on your network, then this could have a significant impact.
If you are in doubt, speak to your IT team who should be able to advise on the IP addresses / CIDR ranges to use, or feel free to get in touch with our support team for further advice.
Resume attempt settings
You can use the Resume Attempt settings to specify when, or if, candidates should be allowed to resume an exam attempt, once it has been started. The options you can choose from are shown below:
Always allowed (default)
Candidates can start and resume their attempt, with no restrictions
Same session
Candidates can resume their attempt, but only from the same device and network that they started it on
Never
Candidates cannot resume their attempt once it has started
🚨 "Never" is a very strict setting that means that a candidate will be kicked out of the exam if they refresh their browser - we only recommend using this in very high-stakes situations, or where you have complete control over the exam environment. "Same session" should provide a strong level of security for most situations, whilst also providing some flexibility for computer crashes or other unexpected situations
Resume configuration
Customise the Restrict by IP resume rules and select an option for whether candidates can resume their exam or if they must submit in one setting. Keep in mind that for timed exams the timer will continue to run down even if the candidate has closed their exam.
Locked
Locked exam attempts can't be started until they are manual unlocked by an admin or educator. Attempts can be locked even if this setting isn't enabled when it is scheduled.
When creating an exam from the communications page select 'Locked'
When an exam is locked and open a student will not be able to start that attempt until it has been unlocked.
To unlock the exam just select the user/s and use the unlock button
When it's unlocked and as long as the open window has been met, users will be able to start their exam as normal
Attempt passcodes
When using Locked exam attempts you can enable the option to allow users to unlock their attempt with a passcode. The passcodes setting can be enabled in the security tab of an exam.
Once enable a passcode will be randomly generated, this can then be entered by users to access the exam.
Code login
Code login lets a candidate start their exam by typing a short code, with no email address, password or account sign-in. It is designed for invigilated test centres where users are not using their own device.
After signing in, the candidate goes straight to their exam. The rest of the platform is hidden: no menus, no other exams, nowhere to browse. When they finish, the machine signs itself out and is ready for the next person.
Code login is for candidates only. If an account also holds an admin, manager, educator or marker role, its code is refused. This is an important security defence to avoid compromising your portal with a leaked code for a privileged account. Administrators testing the flow should use a dedicated student test account rather than their own.
Repeated wrong codes from the same location are rate limited, so the codes cannot be guessed by brute force.
How Code Login works
When enabled code login changes how users sign into the platform and access their attempt. Code login requires Candidate login link and a unique login code and can be configured to require an additional corroborating detail
Candidate login link
Link is the same for all candidates ends in /code-login
Exams > Advanced > Security > Code login
Login code
Unique to each candidate attempt 4 character readable code
Attempt management table
Corroborating detail
Optional but recommended to add additional unique point of information to verify candidates, this can be surname or external id
Exams > Advanced > Security > Code login
Configure code login from Exams > Advanced > Security > Code login.
Tick Enable code login.
Choose a corroborating detail: None, Surname or External ID.
Save
Once enabled a candidate login link is generated, candidates must use this link to login via this method. The link is unique to each exam and is the same for all candidates in that exam, candidates will need their unique login code available on the attempt management table.
Login codes can also be exported in bulk from the attempt management table. Resit or additional attempts for the same user will have different login codes.
Code Login for candidates
Candidates will need to know the code login link, login code and any corroborating detail. Steps to login:
Navigates the candidate login link.
Types their login code and selects Start exam.
If the exam asks for a corroborating detail, a second field appears for their surname or external ID.
They land on the Exam Hall for their attempt, complete any remaining checks such as legal terms or a passcode, and start.
Everything else on the platform is closed to them. If they try to navigate anywhere else, they are returned to their exam. A Sign out button is always available if they need to leave early.
This is particularly useful for invigilated test centres, where candidates can be given a simple code to access their allocated exam without requiring email addresses and account passwords. After login candidates are taken straight to the start exam page, removing additional navigation options to ensure a smooth start to the exam. Learn more about in person online exams in test centres below.
In Person Online Exams GuideAfter the exam has ended
A code login session is deliberately short-lived, and it is bound to the exam it was created for.
During the exam
The session lasts as long as the candidate's attempt window, up to a maximum of eight hours
Candidate submits
The session is cut back to five minutes so they can read their results
Final 30 seconds
A countdown appears, warning that they are about to be signed out
Time runs out
The candidate is signed out and returned to the login page
Candidate signs back in afterwards
Re-entering their code gives them another five minutes with their results
Legal
From the legal page of the exam enabling legal terms will present the candidate with your chosen text that they must accept / acknowledge before they can start an exam.
If enabled, candidates will be presented with the information you enter and will need to accept or acknowledge them before starting the exam. You can select a title, body and checkbox label.
If a user does not select the checkbox, type in their name or other defined static text, they will not be able to start the exam.
Last updated
Was this helpful?