> For the complete documentation index, see [llms.txt](https://academy.synap.ac/doc/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://academy.synap.ac/doc/exams/create-and-manage-exams/4.-advanced-exam-security.md).

# 4. Advanced : Exam Security

## Exam Security

In the advanced settings pages on an exam you'll find a range of additional configurations to add to exams to enhance exam security. 

Synap includes a fully configurable online proctoring solution called **Synoptic**. Synoptic allows organisations to add security controls and monitoring to assessments, ranging from simple browser-based assessments through to high-security, lockdown examinations with continuous recording and live oversight.

For more information, see the **Proctoring with Synoptic** documentation.

{% content-ref url="/pages/FU091z8rRVVPWqQRnVTp" %}
[Proctoring with Synoptic](/doc/exams/proctoring-with-synoptic.md)
{% endcontent-ref %}

{% content-ref url="/pages/04Fp1LA3OG7QerIy9dbJ" %}
[Anti-Cheat features](/doc/exams/anti-cheat-features.md)
{% endcontent-ref %}

### Restrict by IP

You can restrict your exams to a specific IP address, or a set of IP addresses using our IP restriction feature, which can be accessed from **Exams > Advanced > Security > Restrict by IP**.

IP restriction will mean that candidates can only enter the exam if they are accessing from a particular location that you have specified. This can be helpful if, for example you are running a test in a physical test centre, or if you need to ensure that your exam cannot be accessed in certain countries/regions.

When you enable this section, a box will appear which you can use to enter IPs which you want to allow. You should type in 1x IP address per line. 

The box will accept any valid **IPv4 or IPv6** address, as well as [CIDR](https://www.digitalocean.com/community/tutorials/understanding-ip-addresses-subnets-and-cidr-notation-for-networking) ranges.

When enabling this feature, there are a few things you may want to bear in mind:

* Most people's home networks will use dynamic IPs, this means that their IP address will change periodically. For this reason, if you are conducting a remote exam to be taken from candidate's own homes/devices, this option is probably not suitable for you
* If your users are using VPNs, then this may affect the IP that they are connecting from

We strongly recommend testing this feature out, by assigning an exam to your internal team or admins, prior to launching it with real students. Whilst the feature itself is very simple to set up, if the IPs are not set-up correctly, or if there are unexpected proxies/VPNs in-use on your network, then this could have a significant impact. 

If you are in doubt, speak to your IT team who should be able to advise on the IP addresses / CIDR ranges to use, or feel free to get in touch with our support team for further advice. 

<figure><img src="/files/kWOMpDFF9WkqFXuHY3y6" alt=""><figcaption><p>Example of an exam with Restrict by IP enabled. The first IP line shows a specific IPv4 address, and the second line uses CIDR notation to specify a block of IPs from 192.0.2.0 to 192.0.2.24. Candidates will only be allowed into the exam if they are accessing it from one of these IPs</p></figcaption></figure>

<figure><img src="/files/a0cnDRzV1rtwhejQNpUY" alt=""><figcaption><p>Exam that can't be entered as it is being accessed from a non approved IP address</p></figcaption></figure>

### Resume attempt settings

You can use the Resume Attempt settings to specify when, or if, candidates should be allowed to resume an exam attempt, once it has been started. The options you can choose from are shown below:

| Resume setting           | Description                                                                                            |
| ------------------------ | ------------------------------------------------------------------------------------------------------ |
| Always allowed (default) | Candidates can start and resume their attempt, with no restrictions                                    |
| Same session             | Candidates can resume their attempt, but only from the same device and network that they started it on |
| Never                    | Candidates cannot resume their attempt once it has started                                             |

{% hint style="warning" %}
🚨 "**Never**" is a very strict setting that means that a candidate will be kicked out of the exam if they refresh their browser - we only recommend using this in very high-stakes situations, or where you have complete control over the exam environment. "Same session" should provide a strong level of security for most situations, whilst also providing some flexibility for computer crashes or other unexpected situations
{% endhint %}

### **Resume configuration**

Customise the Restrict by IP resume rules and select an option for whether candidates can resume their exam or if they must submit in one setting. <mark style="background-color:yellow;">Keep in mind that for timed exams the timer will continue to run down even if the candidate has closed their exam.</mark>

<figure><img src="/files/IyYtIRuSNeJPfa1v7qoH" alt=""><figcaption></figcaption></figure>

### Locked

Locked exam attempts can't be started until they are manual unlocked by an admin or educator. Attempts can be locked even if this setting isn't enabled when it is scheduled.

When creating an exam from the communications page select 'Locked'

When an exam is locked and open a student will not be able to start that attempt until it has been unlocked.

<figure><img src="/files/BpfwyPrRfQ9n3zleUpGI" alt=""><figcaption><p>Student side locked exam</p></figcaption></figure>

To unlock the exam just select the user/s and use the unlock button&#x20;

<figure><img src="/files/BPDZss894dhFHE0crCxl" alt=""><figcaption><p>Unlocking exam attempts</p></figcaption></figure>

When it's unlocked and as long as the open window has been met, users will be able to start their exam as normal

<figure><img src="/files/OZhvmUt5OLR1ov1k6cfZ" alt=""><figcaption><p>Unlocked attempt ready for the student to start </p></figcaption></figure>

## Attempt passcodes&#x20;

When using Locked exam attempts  you can enable the option to allow users to unlock their attempt with a passcode. The passcodes setting can be enabled in the security tab of an exam.

<figure><img src="/files/KPoXJgLim5Vvs4CcRIJN" alt=""><figcaption><p>Passcodes can be found under the 'Locked' security setting</p></figcaption></figure>

Once enable a passcode will be randomly generated, this can then be entered by users to access the exam.

<figure><img src="/files/vv4jAHDHjt4tIUHh3aw3" alt=""><figcaption></figcaption></figure>

## Code login

Code login allows candidates to access a specific exam with:

* **Candidate login link**: Link is the same for all candidates in that exam, unique to each exam
* **Login code:** unique to each candidate attempt 4 character readable code, available on the attempt management table&#x20;
* **Corroborating detail:** Optional but recommended to add additional unique point of information to verify candidates, this can be surname or external id

<figure><img src="/files/oMqq6mviKNW2y1TZxp7r" alt=""><figcaption></figcaption></figure>

This is particularly useful for invigilated test centres, where candidates can be given a simple code to access their allocated exam without requiring email addresses and account passwords. After login candidates are taken straight to the start exam page, removing additional navigation options to ensure a smooth start to the exam. Learn more about in person online exams in test centres below&#x20;

{% content-ref url="/pages/zTdGl4M95HfyJpzpdcNf" %}
[In Person Online Exams Guide](/doc/exams/remote-exam-planning-guide/in-person-online-exams-guide.md)
{% endcontent-ref %}

Code login can be enabled and configured on the exam security page. We strongly recommend for improved security having a corroborating detail enabled though this is not required.&#x20;

<figure><img src="/files/dyD2CtDGayJdnVvdYrJf" alt=""><figcaption></figcaption></figure>

Once enabled a candidate login link is generated, candidates must use this link to login via this method. The link is unique to each exam and is the same for all candidates in that exam, candidates will need their unique login code available on the attempt management table.&#x20;

<figure><img src="/files/Yz93waysNVfm904vYcE3" alt=""><figcaption><p>Attempt management login codes</p></figcaption></figure>

Login codes can also be exported in bulk from the attempt management table. Note that resit or additional attempts for the same user will have different login codes.&#x20;

## Legal

From the legal page of the exam enabling legal terms will present the candidate with your chosen text that they must accept / acknowledge before they can start an exam.&#x20;

<figure><img src="/files/5eVMajbxqPa0O7TuWNlN" alt=""><figcaption></figcaption></figure>

If enabled, candidates will be presented with the information you enter and will need to accept or acknowledge them before starting the exam.  You can select a title, body and checkbox label.

If a user does not select the checkbox, type in their name or other defined static text, they will not be able to start the exam.

<figure><img src="/files/px6VvgRimY3jaxwVlv0o" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
We recommend including the title - Legal - within the checkbox label. This makes it explicitly clear to candidates what the checkbox is related to
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://academy.synap.ac/doc/exams/create-and-manage-exams/4.-advanced-exam-security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.