4. Advanced : Exam Security

A look at the advanced and security options that can be configured on exams

Exam Security

In the advanced settings pages on an exam you'll find a range of additional configurations to add to exams to enhance exam security.

Synap includes a fully configurable online proctoring solution called Synoptic. Synoptic allows organisations to add security controls and monitoring to assessments, ranging from simple browser-based assessments through to high-security, lockdown examinations with continuous recording and live oversight.

For more information, see the Proctoring with Synoptic documentation.

Proctoring with SynopticAnti-Cheat features

Restrict by IP

You can restrict your exams to a specific IP address, or a set of IP addresses using our IP restriction feature, which can be accessed from Exams > Advanced > Security > Restrict by IP.

IP restriction will mean that candidates can only enter the exam if they are accessing from a particular location that you have specified. This can be helpful if, for example you are running a test in a physical test centre, or if you need to ensure that your exam cannot be accessed in certain countries/regions.

When you enable this section, a box will appear which you can use to enter IPs which you want to allow. You should type in 1x IP address per line.

The box will accept any valid IPv4 or IPv6 address, as well as CIDR ranges.

When enabling this feature, there are a few things you may want to bear in mind:

• Most people's home networks will use dynamic IPs, this means that their IP address will change periodically. For this reason, if you are conducting a remote exam to be taken from candidate's own homes/devices, this option is probably not suitable for you

• If your users are using VPNs, then this may affect the IP that they are connecting from

We strongly recommend testing this feature out, by assigning an exam to your internal team or admins, prior to launching it with real students. Whilst the feature itself is very simple to set up, if the IPs are not set-up correctly, or if there are unexpected proxies/VPNs in-use on your network, then this could have a significant impact.

If you are in doubt, speak to your IT team who should be able to advise on the IP addresses / CIDR ranges to use, or feel free to get in touch with our support team for further advice.

Example of an exam with Restrict by IP enabled. The first IP line shows a specific IPv4 address, and the second line uses CIDR notation to specify a block of IPs from 192.0.2.0 to 192.0.2.24. Candidates will only be allowed into the exam if they are accessing it from one of these IPs

Exam that can't be entered as it is being accessed from a non approved IP address

Resume attempt settings

You can use the Resume Attempt settings to specify when, or if, candidates should be allowed to resume an exam attempt, once it has been started. The options you can choose from are shown below:

Resume setting	Description
Always allowed (default)	Candidates can start and resume their attempt, with no restrictions
Same session	Candidates can resume their attempt, but only from the same device and network that they started it on
Never	Candidates cannot resume their attempt once it has started

🚨 "Never" is a very strict setting that means that a candidate will be kicked out of the exam if they refresh their browser - we only recommend using this in very high-stakes situations, or where you have complete control over the exam environment. "Same session" should provide a strong level of security for most situations, whilst also providing some flexibility for computer crashes or other unexpected situations

Resume configuration

Customise the Restrict by IP resume rules and select an option for whether candidates can resume their exam or if they must submit in one setting. Keep in mind that for timed exams the timer will continue to run down even if the candidate has closed their exam.

Locked

Locked exam attempts can't be started until they are manual unlocked by an admin or educator. Attempts can be locked even if this setting isn't enabled when it is scheduled.

When creating an exam from the communications page select 'Locked'

When an exam is locked and open a student will not be able to start that attempt until it has been unlocked.

Student side locked exam

To unlock the exam just select the user/s and use the unlock button

Unlocking exam attempts

When it's unlocked and as long as the open window has been met, users will be able to start their exam as normal

Unlocked attempt ready for the student to start

Attempt passcodes

When using Locked exam attempts you can enable the option to allow users to unlock their attempt with a passcode. The passcodes setting can be enabled in the security tab of an exam.

Passcodes can be found under the 'Locked' security setting

Once enable a passcode will be randomly generated, this can then be entered by users to access the exam.

Code login

Code login allows candidates to access a specific exam with:

• Candidate login link: Link is the same for all candidates in that exam, unique to each exam

• Login code: unique to each candidate attempt 4 character readable code, available on the attempt management table

• Corroborating detail: Optional but recommended to add additional unique point of information to verify candidates, this can be surname or external id

This is particularly useful for invigilated test centres, where candidates can be given a simple code to access their allocated exam without requiring email addresses and account passwords. After login candidates are taken straight to the start exam page, removing additional navigation options to ensure a smooth start to the exam. Learn more about in person online exams in test centres below

In Person Online Exams Guide

Code login can be enabled and configured on the exam security page. We strongly recommend for improved security having a corroborating detail enabled though this is not required.

Once enabled a candidate login link is generated, candidates must use this link to login via this method. The link is unique to each exam and is the same for all candidates in that exam, candidates will need their unique login code available on the attempt management table.

Attempt management login codes

Login codes can also be exported in bulk from the attempt management table. Note that resit or additional attempts for the same user will have different login codes.

Legal

From the legal page of the exam enabling legal terms will present the candidate with your chosen text that they must accept / acknowledge before they can start an exam.

If enabled, candidates will be presented with the information you enter and will need to accept or acknowledge them before starting the exam. You can select a title, body and checkbox label.

If a user does not select the checkbox, type in their name or other defined static text, they will not be able to start the exam.

We recommend including the title - Legal - within the checkbox label. This makes it explicitly clear to candidates what the checkbox is related to