An online exam is only as trustworthy as its audit trail. Marks decide admissions, degrees and jobs — so when a result is questioned, "the database says so" isn't an answer. A logged, reconstructable record of every event is.
The threat model
The obvious risk in online exams is candidate cheating — covered by proctoring and secure browsers. The subtler risk is data integrity: unauthorized access to the administration panel, manipulation of stored responses, or a disputed result with no way to prove what actually happened. Audit logging addresses exactly this layer.
What gets logged
| # | Event | What the log captures |
|---|---|---|
| 1 | Candidate login | IP address and time; requests from invalid IPs blocked |
| 2 | Exam start | Per-candidate start timestamp |
| 3 | Exam resume | Reconnection time after internet failure — no lost attempts, no free time |
| 4 | Password reset | Attempt count and request timing — brute-force becomes visible |
| 5 | Response click | Every answer selection, per question, with timestamp |
| 6 | Navigation | The candidate's movement through the paper |
| 7 | Exam finish | Per-candidate submission timestamp |
| 8 | Admin activity | Every result view, report generation and change — with user and IP |
The response-click log is the one that settles disputes: a result challenged months later can be verified click by click against what the candidate actually selected — independent of the stored score.
Locking down administration
Candidate-side security means nothing if the admin panel is open. Two controls close it:
Every admin session is itself logged — who viewed which results, who generated which report, from which IP. Accountability applies to the institution's own staff, not just candidates.
What logging changes in practice
❌ Without an audit trail
- Disputed result = candidate's word vs. institution's
- Tampering undetectable after the fact
- Disconnections become grievance cases
- Admin access invisible and unaccountable
✅ With full event logging
- Any result replayed from click-level logs
- Every access stamped with user, IP, time
- Resume events prove fair time handling
- Regulator and court-ready evidence trail
Part of a complete security posture
Audit logging is one layer of exam security — it works alongside question-paper protection, proctoring and malpractice prevention during the exam itself. Together they cover the full chain: before, during and after the assessment.
Eklavvya, the assessment platform from the ePravesh family, logs every exam and admin event as standard, with 100,000+ exams conducted on the platform. Book a free demo to see the audit trail live.
Frequently Asked Questions
What is audit logging in an online exam system?
A tamper-evident record of every significant event — logins, exam start/resume/finish, every answer click, navigation and admin actions — each stamped with user, time and IP address, so any result can be reconstructed and verified after the fact.
Which events should an online exam platform log?
At minimum — candidate login (with IP), exam start, resume after disconnection, every response click, navigation between questions, exam finish, password-reset attempts, and every admin action on results or reports.
How do IP restrictions protect exam administration?
The admin panel can be locked to a whitelist of authorized IP addresses, so even stolen credentials can't be used from an unauthorized location — access attempts from unknown IPs are blocked and logged.
Why do answer-click logs matter?
They make results defensible — if a score is ever disputed or tampering is alleged, the click-by-click log proves what the candidate actually answered and when, independent of the stored result.