Exam Security Settings Checklist: Randomization, Timers and Access Rules

Exam security settings are the switches in a testing platform that decide who can start an exam, when, for how long, and which questions each person sees. Good exam security for a training provider means setting three groups on purpose, randomization, timers and access rules, at a level that matches the stakes, and then testing them before launch.

This post is the configuration layer. Our guide to reducing cheating in online exams without full proctoring covers which controls address which cheating method. Here you get a starting value for each setting by stakes tier, the ways each setting breaks, a worked timer example and a launch test. Setting names differ by platform, so examples come from Moodle and Canvas documentation as of October 2026. It is written for people who configure exams themselves.

Key takeaways

• Set exam security in this order: access rules, question delivery, timers, then results and interruptions, because each later group depends on the earlier ones.
• Draw questions by blueprint area and pin any answer option whose meaning depends on its position, such as “all of the above”; otherwise random forms can differ in coverage or contain broken items.
• Base the time limit on a pilot, then set the window close to the last start time plus the longest individual timer, or learners with extra time get cut off by the window.
• Withhold correct answers until the window closes for everyone, and decide before launch what happens when a learner’s connection drops.

Which exam security settings should you set first, and what value fits your stakes?

Set access rules first, then question delivery, then timers, then results and interruption handling. Each group depends on the one before: a timer means little if the exam stays open all week, and shuffled questions help little if correct answers appear after the first learner finishes. The table gives a starting value for each setting by stakes tier.

The tiers are this post’s own framing, not a standard. To place a specific exam in a tier, use the scoring method in our proctoring guide for training providers. No row below confirms who is sitting the exam; high-stakes exams still need an identity check by a person.

How should you set randomization without breaking your questions?

Randomize in three layers: draw questions from a bank by blueprint area, shuffle answer options where order carries no meaning, and shuffle question order only inside sections that stand alone. Each layer lowers answer sharing and each can also break an item or make forms uneven, so every layer needs a check.

Which answer options should you pin in place?

Pin any option that refers to other options or has a natural order. Canvas’s published security guidance says to avoid shuffling answers when options such as “all of the above” or “A & C” appear. Better still, rewrite the item so no option points at another. If your platform cannot pin an option, switch shuffling off for that item.

Also pin options with a natural sequence, such as numeric ranges, never-to-always scales and process steps, and remove letters from stems, because letters move when options shuffle.

How do you draw questions from a bank by blueprint?

Draw a fixed number of items from each blueprint area, not 30 items from one flat pool. A flat draw can hand one learner 16 safety items and 5 regulation items while another gets the reverse. The ITC and ATP Guidelines for Technology-Based Assessment (2022) state in guideline 2.2 that “if multiple linear forms are being administered, they should be parallel.”

Here is a worked example with illustrative numbers. A 30-item exam has a blueprint of 12 safety, 10 procedure and 8 regulation items. With a bank of 36, 30 and 24 items in those areas (3 times the draw), every learner gets exactly 12, 10 and 8. Two learners share about 4 + 3.3 + 2.7 = 10 items on average, assuming independent random draws. That matches the pool arithmetic in our post on reducing cheating. Our guide to building an item bank covers the tags you need to draw this way.

Should you shuffle question order as well?

Shuffle order only where items stand alone. Keep a scenario together with its questions, and keep items that give away or depend on each other in a fixed sequence. This is a practical rule, not a published standard.

Pro tip: Read Three Generated Forms Cold. Before launch, generate three forms and read each start to finish as a learner would. Look for a stem that answers another item, a “see the previous question” reference, a scenario split from its items, and uneven topic counts. Settings screens never show these faults; reading does.

How long should the exam timer be, and what should happen at zero?

Start from about one minute per standard multiple-choice item, add more for scenario items, then replace the guess with pilot data. One published study of online multiple-choice tests found an average of 39 seconds per question. The ITC and ATP guidelines say limits should rest on evidence, not a round number.

The study is Kennette and McGuckin (2025) in Teaching and Learning Inquiry. It covered diploma students in one online introductory psychology course and found they spent significantly more time per question on single-attempt unit tests than on quizzes. It measured multiple-choice items only, so treat 39 seconds as a benchmark for recall items, not a target for scenario items. Guideline 2.10 of the ITC and ATP document says “time limits should be based on an empirically derived threshold rather than an arbitrarily selected one.”

The table walks through one example. The planning figures, the pilot times and the 1.5 multiplier are illustrative, and the rounding rule is this post’s suggestion, not a standard.

If several pilot learners are still answering in the last five minutes, the exam may be speeded, so lengthen it. The ITC and ATP guidelines call for “timing analysis to assess speededness” (guideline 2.4).

What should the clock do at zero?

Auto-submit what the learner has answered. Moodle’s quiz settings offer three choices: open attempts are submitted automatically (the default), a grace period lets open attempts be submitted without new answers, or attempts must be submitted before time expires or they are not counted. The third punishes a slow connection, so use it only with a clear reason.

How do extra-time accommodations change the window?

A window that closes at 10:15 cuts off an extra-time learner who started at 9:00 and needs until 10:30. Canvas’s guidance says its availability end date submits the quiz at that moment, even for students still working, and that a due date alone does not block late work. Set the close to the last start plus the longest individual timer, or give that learner an override (Canvas allows extra time per student).

The accommodation process itself, including who decides and how WCAG treats timing, is in our guide to accessible online exams.

Which access rules should you set for an online exam?

Set four rules: a start window, a way to start (login, unique link or access code), an optional network restriction and an attempt limit. Together they decide who can begin, when and how often. They control entry only. None of them confirms who is at the keyboard, which is why high-stakes exams add an identity check.

How should you set the start window?

Define three times: when access opens, the last time a learner may start and when the window closes. Moodle’s documentation says that after closing, students cannot start new attempts. A narrow window also helps because the ITC and ATP guidelines warn that late test takers in a long window may gain prior knowledge of content.

Do network restrictions work for remote learners?

Not well. A restriction limits where an exam can start, so it fits a training venue where everyone shares a network. Moodle accepts a full address, a partial address or CIDR notation, and does not accept domain names. Learners at home have addresses you cannot predict, so a list would block honest people. Canvas’s guidance adds that its address filter needs coordination with the platform administrator.

How many attempts should a learner get?

For a scored exam, one attempt, with retakes on a different form after a delay. Canvas’s guidance calls multiple attempts weak for security unless the bank is large or the goal is mastery. Moodle supports an enforced delay between attempts and lets you choose whether the highest, average, first or last grade counts.

Pro tip: Rotate the Access Code After Everyone Starts. Canvas’s guidance notes that an access code can be changed during a quiz to lock students out. In a live session, change the code once everyone has started, so a forwarded code is useless. Write the new code down first, for the learner whose connection drops and who needs back in.

What should you set for results, feedback and dropped connections?

Hide correct answers and item feedback until the window closes for everyone, and write down what happens when a connection drops. Canvas’s guidance stresses that availability dates do not control whether learners can see results; separate response and correct-answer settings do, so check them on every exam. Release the score first if learners need it, and the answers later.

Plan for interruptions too. The ITC and ATP guidelines say a significant disruption is “one of the most damaging events” in administration, that systems should “prevent the loss of test taker response data,” and that test takers should be able to resume with as much completed work credited as possible. Decide in advance whether the clock keeps running during a short drop, who approves a resume, and where it is logged.

How do you test your exam security settings before launch?

Run the exam as three test learners before real learners see it: a standard learner, an extra-time learner and one who should be refused entry. Settings screens show what you chose, not what the platform does, so watch each rule pass or fail once.

Step 1: Build the test accounts. Create a standard account, an extra-time account with its longer timer, and a third that lacks the access code or sits on the wrong network.

Step 2: Check entry. Try to start each exam inside and outside the window. The third account should be refused. Confirm the last-start time works.

Step 3: Let a timer run out. Leave the standard exam unanswered at zero and confirm what the platform submits and how it scores.

Step 4: Run past the standard close. Keep the extra-time exam open beyond the standard window close and confirm it is not cut off.

Step 5: Drop the connection. Close the browser mid-exam, return, and check that answers and the clock match your written rule.

Step 6: Look as a learner. After submitting, see what the account shows: score, answers, feedback. Compare it with your plan and record the settings, the date and who tested them.

What should you do next?

Pick your most important exam, place it in a tier and fill in the matching column of the first table. Then run the six-step test and keep the one-page record with the exam file, so the next person who edits the exam knows what each setting was meant to do.

Then check what your platform supports before you design around it. As of October 2026, the SimpliAssess features page lists item banking, test management, examinee management and schedule management; it does not describe randomization, timers, access codes, network restrictions or attempt limits, so confirm each in writing with any vendor.

If you also need delivery and scheduling in one system, SimpliTrain’s question bank page says it randomizes question selection and answer order for every exam attempt, within rules an admin sets for questions per topic and difficulty tier. That page does not describe time limits, windows or access codes in detail, so ask about those in a demo.

Frequently asked questions

What are the most important exam security settings?

Four matter most: access rules (a narrow window, individual logins or an access code, and an attempt limit), a blueprint-based question draw with pinned answer options, a pilot-based time limit, and delayed release of correct answers. None confirms identity, so high-stakes exams still need a person to check who is sitting.

Should you randomize question order, answer options or both?

Both can be on, with limits. Shuffle answer options except where an option refers to others or has a natural order, and pin those. Shuffle question order only among items that stand alone. Draw by blueprint area first, so every learner still gets the same topic coverage whatever the order.

How long should an online exam time limit be?

Start at about one minute per standard multiple-choice item and more for scenario items, then pilot it. One study of online multiple-choice tests found a 39-second average per question. The ITC and ATP guidelines say limits should rest on evidence, so set the final figure from pilot completion times.

Does an IP restriction secure a remote online exam?

No, it mostly suits in-person delivery. An address restriction limits where an exam can start, so it works at a venue where everyone shares a network. Remote learners’ home addresses are not predictable, so a list blocks honest people. It also does not confirm who is at the keyboard.

How many attempts should learners get on a scored exam?

One scored attempt is the safest default. If you allow retakes, use a different form and an enforced delay, which platforms such as Moodle support. Canvas’s guidance calls multiple attempts weak for security unless the question bank is large or the goal is mastery. Practice quizzes can allow several.

Should you turn on every security setting?

No. Each restriction has a cost, and Canvas’s guidance says locking down a quiz can hinder learning, so weigh the positives and negatives against the exam’s goal. Strict timers and sequential navigation can disadvantage some learners. Match settings to the stakes, test them, and keep a record of why each is on.