> For the complete documentation index, see [llms.txt](https://academy.synap.ac/doc/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://academy.synap.ac/doc/exams/create-and-manage-exams/4.-advanced-exam-security.md). # 4. Advanced : Exam Security ## Exam Security In the advanced settings pages on an exam you'll find a range of additional configurations to add to exams to enhance exam security. Synap includes a fully configurable online proctoring solution called **Synoptic**. Synoptic allows organisations to add security controls and monitoring to assessments, ranging from simple browser-based assessments through to high-security, lockdown examinations with continuous recording and live oversight. For more information, see the **Proctoring with Synoptic** documentation. {% content-ref url="/pages/FU091z8rRVVPWqQRnVTp" %} [Proctoring with Synoptic](/doc/exams/proctoring-with-synoptic.md) {% endcontent-ref %} {% content-ref url="/pages/04Fp1LA3OG7QerIy9dbJ" %} [Anti-Cheat features](/doc/exams/anti-cheat-features.md) {% endcontent-ref %} ### Restrict by IP You can restrict your exams to a specific IP address, or a set of IP addresses using our IP restriction feature, which can be accessed from **Exams > Advanced > Security > Restrict by IP**. IP restriction will mean that candidates can only enter the exam if they are accessing from a particular location that you have specified. This can be helpful if, for example you are running a test in a physical test centre, or if you need to ensure that your exam cannot be accessed in certain countries/regions. When you enable this section, a box will appear which you can use to enter IPs which you want to allow. You should type in 1x IP address per line. The box will accept any valid **IPv4 or IPv6** address, as well as [CIDR](https://www.digitalocean.com/community/tutorials/understanding-ip-addresses-subnets-and-cidr-notation-for-networking) ranges. When enabling this feature, there are a few things you may want to bear in mind: * Most people's home networks will use dynamic IPs, this means that their IP address will change periodically. For this reason, if you are conducting a remote exam to be taken from candidate's own homes/devices, this option is probably not suitable for you * If your users are using VPNs, then this may affect the IP that they are connecting from We strongly recommend testing this feature out, by assigning an exam to your internal team or admins, prior to launching it with real students. Whilst the feature itself is very simple to set up, if the IPs are not set-up correctly, or if there are unexpected proxies/VPNs in-use on your network, then this could have a significant impact. If you are in doubt, speak to your IT team who should be able to advise on the IP addresses / CIDR ranges to use, or feel free to get in touch with our support team for further advice.

Example of an exam with Restrict by IP enabled. The first IP line shows a specific IPv4 address, and the second line uses CIDR notation to specify a block of IPs from 192.0.2.0 to 192.0.2.24. Candidates will only be allowed into the exam if they are accessing it from one of these IPs

Exam that can't be entered as it is being accessed from a non approved IP address

### Resume attempt settings You can use the Resume Attempt settings to specify when, or if, candidates should be allowed to resume an exam attempt, once it has been started. The options you can choose from are shown below: | Resume setting | Description | | ------------------------ | ------------------------------------------------------------------------------------------------------ | | Always allowed (default) | Candidates can start and resume their attempt, with no restrictions | | Same session | Candidates can resume their attempt, but only from the same device and network that they started it on | | Never | Candidates cannot resume their attempt once it has started | {% hint style="warning" %} 🚨 "**Never**" is a very strict setting that means that a candidate will be kicked out of the exam if they refresh their browser - we only recommend using this in very high-stakes situations, or where you have complete control over the exam environment. "Same session" should provide a strong level of security for most situations, whilst also providing some flexibility for computer crashes or other unexpected situations {% endhint %} ### **Resume configuration** Customise the Restrict by IP resume rules and select an option for whether candidates can resume their exam or if they must submit in one setting. Keep in mind that for timed exams the timer will continue to run down even if the candidate has closed their exam.
### Locked Locked exam attempts can't be started until they are manual unlocked by an admin or educator. Attempts can be locked even if this setting isn't enabled when it is scheduled. When creating an exam from the communications page select 'Locked' When an exam is locked and open a student will not be able to start that attempt until it has been unlocked.

Student side locked exam

To unlock the exam just select the user/s and use the unlock button

Unlocking exam attempts

When it's unlocked and as long as the open window has been met, users will be able to start their exam as normal

Unlocked attempt ready for the student to start

## Attempt passcodes When using Locked exam attempts you can enable the option to allow users to unlock their attempt with a passcode. The passcodes setting can be enabled in the security tab of an exam.

Passcodes can be found under the 'Locked' security setting

Once enable a passcode will be randomly generated, this can then be entered by users to access the exam.
## Code login Code login lets a candidate start their exam by typing a short code, with no email address, password or account sign-in. It is designed for invigilated test centres where users are not using their own device. After signing in, the candidate goes straight to their exam. The rest of the platform is hidden: no menus, no other exams, nowhere to browse. When they finish, the machine signs itself out and is ready for the next person.
Code login is for candidates only. If an account also holds an admin, manager, educator or marker role, its code is refused. **This is an important security defence to avoid compromising your portal with a leaked code for a privileged account**. Administrators testing the flow should use a dedicated student test account rather than their own. Repeated wrong codes from the same location are rate limited, so the codes cannot be guessed by brute force. {% hint style="info" %} Code login deliberately lowers identity assurance. Anyone holding a candidate's code and corroborating detail can start their exam. Use it only where you control how codes are distributed, such as a supervised test centre. {% endhint %} ### How Code Login works When enabled code login changes how users sign into the platform and access their attempt. Code login requires Candidate login link and a unique login code and can be configured to require an additional corroborating detail | Detail | Description | Where to find it | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- | | **Candidate login link** | Link is the same for all candidates ends in `/code-login` | **Exams > Advanced > Security > Code login** | | **Login code** | Unique to each candidate attempt 4 character readable code | **Attempt management** table | | **Corroborating detail** | Optional but recommended to add additional unique point of information to verify candidates, this can be surname or external id | **Exams > Advanced > Security > Code login** | Configure code login from **Exams > Advanced > Security > Code login**. * Tick **Enable code login**. * Choose a **corroborating detail**: **None**, **Surname** or **External ID**. * Save
Once enabled a candidate login link is generated, candidates must use this link to login via this method. The link is unique to each exam and is the same for all candidates in that exam, candidates will need their unique login code available on the attempt management table. Login codes can also be exported in bulk from the attempt management table. Resit or additional attempts for the same user will have **different** login codes.

Attempt management login codes

### Code Login for candidates Candidates will need to know the code login link, login code and any corroborating detail. Steps to login: 1. Navigates the candidate login link. 2. Types their login code and selects **Start exam**. 3. If the exam asks for a corroborating detail, a second field appears for their surname or external ID. 4. They land on the Exam Hall for their attempt, complete any remaining checks such as legal terms or a passcode, and start. Everything else on the platform is closed to them. If they try to navigate anywhere else, they are returned to their exam. A **Sign out** button is always available if they need to leave early. This is particularly useful for invigilated test centres, where candidates can be given a simple code to access their allocated exam without requiring email addresses and account passwords. After login candidates are taken straight to the start exam page, removing additional navigation options to ensure a smooth start to the exam. Learn more about in person online exams in test centres below. {% content-ref url="/pages/zTdGl4M95HfyJpzpdcNf" %} [In Person Online Exams Guide](/doc/exams/remote-exam-planning-guide/in-person-online-exams-guide.md) {% endcontent-ref %} #### After the exam has ended A code login session is deliberately short-lived, and it is bound to the exam it was created for. | Situation | What happens | | ---------------------------------- | ------------------------------------------------------------------------------------------- | | During the exam | The session lasts as long as the candidate's attempt window, up to a maximum of eight hours | | Candidate submits | The session is cut back to **five minutes** so they can read their results | | Final 30 seconds | A countdown appears, warning that they are about to be signed out | | Time runs out | The candidate is signed out and returned to the login page | | Candidate signs back in afterwards | Re-entering their code gives them another five minutes with their results |
## Legal From the legal page of the exam enabling legal terms will present the candidate with your chosen text that they must accept / acknowledge before they can start an exam.
If enabled, candidates will be presented with the information you enter and will need to accept or acknowledge them before starting the exam. You can select a title, body and checkbox label. If a user does not select the checkbox, type in their name or other defined static text, they will not be able to start the exam.
{% hint style="info" %} We recommend including the title - Legal - within the checkbox label. This makes it explicitly clear to candidates what the checkbox is related to {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://academy.synap.ac/doc/exams/create-and-manage-exams/4.-advanced-exam-security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.