Conducting exams in which a computer (but no internet) is available

Question

In my institution, we have various lab exams in which part of the exam is completing a programming task, and a computer is available to each student for this purpose.

There are there various ways to submit the exercise then: for instance, files can be submitted through a dedicated web service (elegant and easy to use, but it needs to be coded by hand and the grading is more complicated if there is also a pen-and-paper part to match), or the student is asked to copy the program/function on paper (tedious, but simple to implement).

Clearly, in this exam format it would be desirable to limit access to the internet, to reduce the possibilities to cheat and (in exams where this is forbidden) look up external information. This task seems complicated because

• some network access is necessary for the computer infrastructure to work (for instance, network logon)
• some programs may require additional network access: for instance, Matlab campus installations usually require access to a "license server" installed on a university-controlled machine
• the exam itself may also require the network somehow: for instance, to download test files, or for the interface to submit exercises mentioned above.

My experience is that IT administrators are reluctant to provide something like this, and that the result is quite error-prone: limiting the network access is tricky to do, it often fails and usually it leaves room for loopholes (for instance, the students can still chat to each other with netcat). Ideally, a fully locked-down "exam mode" would also have some more features, like forbidding access to USB sticks, but this also must be implemented by hand.

With this premise, my questions are:

1. Is this way of conducting exams common also in other institutions/university systems/nations? Is it inherently bad, or does it have some pitfalls that I have overlooked?
2. Is there an easy way to implement a "locked-down exam mode" on a computer (with either of Windows, Mac, and Linux, or rather, possibly, all of them) by using standard products? Are they effective, or are they easy to circumvent? Or does everyone roll their own hand-crafted solution? Some operating systems ofter "guest modes", which are a good starting point, but some more configuration is needed.
3. Is it normal for us teachers to ask the IT service to hack together something to implement this mode? Are there any technology suggestions that we can give them to make it more effective?
4. Should I (as an instructor) expect this "locked down exam mode", once implemented, to work seamlessly out-of-the-box, or is it something that is inherently clunky and error-prone?

Answer 1

My university in the UK provides such "locked down exam mode". Students log in with special "exam accounts", while their normal accounts are disabled for the time being. Exam accounts have limited access to network, permitting access to the University network (including submission servers, licensing servers, and other necessary infrastructure), and restricting access to anything else. This has been working well for the last 10-ish years at least, and I have not heard any major complaints from IT staff about it. For comparison, the same IT staff found it difficult to install TexLive on all university computers and were reluctant to perform this task.

Answer 2

Your locked-down exam mode only need to be some special network rules. You probably want it to be a restriction so that the computer can only communicate with:

• The Active Directory
• The license server
• The server providing the questions
• The server where answers are submitted
• Maybe a DNS server

This could be performed locally at the client. For instance on Linux that would simply make a few iptables/nftables rules. You can probably get a Windows firewall with similar features, too.

But it can also be done at the network level, by making the switch on the laboratory performing the filtering (but importantly, you need client isolation to be enabled).

The main issue I foresee is actually on the features the allowed hosts provide. For instance, your institution is likely to be using a learning management system that allows sharing of materials, requesting submissions, etc. but it could end up being too powerful, such as allowing:

• Private messages between students
• Messages on a forum of a different subject
• 'Public' messages that are then quickly deleted
• Downloading of class materials that were not supposed to be used (theory, solutions from previous years...)
• Access to the contents by students not present in the room (from a different group, arriving late...)
• Submissions by a third not present in the room (which may know the credentials of a student which is there)

So I would go for a dedicated "exam server" that did just that thing and did it well.

---

If you don't have the means to do that, eg. you are not supposed to do such changes, or it would need support by a different department (IT?), which doesn't welcome such ideas, here is a low-tech procedure:

• Computers are networked and students log in and open needed programs as usual
• Students download a password-protected zip file¹ with the assignment as well as any supporting files required
• (NB: that students will download here everything they can, so this better be an open-book exam)
• Instructor disables network for the computer (either centrally or physically by removing the network cable from each computer)
• Instructor reveals the assignment password
• Students code their answer
• Students prepare the file they will submit
• Students write down on paper the hash for their submission (preferably on an Optical mark recognition paper) and provide it to the examiner
• After receiving the results from everyone, network access is restored and the students upload their submissions
• Later that day, the instructor verifies that the submitted files indeed match the electronic submission, and performs the grading.

This way both students and examiners get the advantage of actually using digital files (no manual copying or grading of paper code!), while being a sound procedure^{citation needed} requiring a minimum of technology support.

.

¹ The filenames are not encrypted in this format, so avoid tipping the exam contents on them!