A security plan is useful when a teacher can say what might go wrong, which control addresses it, and what to do if that control fails. Start with the assessment itself: what should a passing student be able to demonstrate, and which resources are permitted? Monitoring settings should follow those decisions.
This guide uses ZYNQO’s browser exam as a concrete example. The scenarios below are illustrative planning exercises, not results from an institution or evidence that a control prevents cheating.
Write the permitted-resources rule first
“No cheating” is not enough to configure a session. Specify whether notes, calculators, translation tools, an assistant or generative AI are allowed, and for which tasks. Include approved breaks and assistive technology. For a short retrieval quiz, collecting camera data may add complexity without helping the learning objective. For a consequential assessment, an institution may need a separate identity check and a documented review process.
A small risk register for one assessment
| Risk | Preparation | Remaining limit |
|---|---|---|
| A question is shared | Use variants that assess the same objective; review exposed questions before reusing them. | Watermarks and copy restrictions cannot prevent a photo from another device. |
| An answer is produced with prohibited help | Ask for intermediate reasoning and define the permitted resources. Where appropriate, plan a consistent follow-up explanation. | A plausible answer alone cannot establish who produced it. |
| A legitimate student triggers an alert | Rehearse zoom, keyboard access, accommodations and notifications. Assign a reviewer. | Focus, face and object signals can be wrong or ambiguous. |
| The connection fails | Test answer restoration and submission in a practice session. Agree a recovery contact. | An answer not successfully saved may be unavailable after a reload. |
Understand what the browser records
A page can observe visibility and focus changes. It cannot infer why the student left the page or reliably identify the other application. The Page Visibility API documentation explains what visibility events describe. Treat a focus event as an observation to investigate, not an accusation.
ZYNQO also uses camera-based detection when enabled. Missing-face and object alerts depend on what the camera sees and the model recognises. They do not cover a second device outside the frame. See the monitoring guide and screen-capture limits before selecting settings.
Check automatic submission before the sitting
The current exam flow supports a proctor-configured violation limit. If enabled, reaching the limit can submit the exam automatically. That is a product action, not a finding that misconduct occurred. Test the warning and limit in a dummy session. Tell candidates about the rule and agree how an incorrect alert or accommodation conflict will be handled before starting the graded sitting.
Work through an ambiguous incident
Illustrative case: a focus event and a missing-face event occur close together. The student says their connection dropped and they moved to reconnect a cable. Two events are not necessarily two independent pieces of evidence; both may come from one interruption.
- Record the event time, session settings and the student’s account of what happened.
- Check whether answers saved, a warning appeared or automatic submission occurred.
- Consider permitted breaks, accessibility needs and device problems before drawing an inference.
- If the record cannot establish the cause, record that uncertainty. Apply the institution’s published review and appeal process.
A review note should distinguish an observation (“the page became hidden”) from an interpretation (“the student sought outside help”). It should also identify what evidence would be needed to resolve the interpretation. Do not retrospectively invent a rule for one student.
Rehearse and decide whether to proceed
Run the same join, monitoring, answer-save and submission sequence candidates will use. Include a permitted interruption and one connection failure in the practice session. If submission or an essential accommodation does not work, resolve it or choose another assessment route before the graded sitting.
Use the 12-point readiness checklist to record the outcome and export the handoff. After the exam, review incidents and ambiguous questions before reusing the configuration. More alerts do not, by themselves, show a more secure assessment.