There is a version of exam security that is purely defensive — more cameras, more lockdown, more monitoring. It treats the assessment itself as fixed and tries to wall it off. The trouble is that the wall keeps losing, because the tools attacking it improve faster than the wall does.

The other lever barely gets mentioned: the questions. Change what you ask, and you can make a looked-up answer almost worthless without watching anyone more closely. It is the cheapest security upgrade available, and it improves the assessment for honest students at the same time.

Why recall questions are the soft target

A question with a single, stable, fact-shaped answer is the perfect target for an assistance tool. "What is the capital of…", "Define…", "Which of these four…". These compress into a prompt and expand into an answer in under a second. If your exam is mostly recall, you are not really testing the candidate against the tool — you are testing the tool, and the candidate is just holding the phone.

This is the same accessibility-and-availability problem the cheating market exploits, which we described in exam fraud is an ecosystem problem. The answer is not to monitor recall harder. It is to ask less of it.

Questions that resist a quick lookup

Some shapes are genuinely awkward for a tool that excels at producing a confident paragraph:

  • Apply-to-this-case. Give a specific, slightly messy scenario and ask for a decision plus a justification. Generic answers stand out immediately against a concrete case.
  • Critique a worked solution. Hand the candidate a flawed answer and ask where it goes wrong. Spotting a subtle error is harder to fake than producing a tidy paragraph.
  • Show the path, not just the result. Ask for the reasoning, the discarded options, the trade-off. A correct final number with no defensible route is a tell.
  • Tie it to something only this cohort saw — a dataset from the course, a case discussed in class, a local constraint. Context the tool never had is context it cannot fake.
The goal is not to make questions hard. It is to make the answer worth little without the person — so the easy route stops paying.

Open-book on purpose

If a fact can be found in seconds, pretending it cannot is a losing game. Many programmes are better off going deliberately open-book and raising the cognitive bar instead. When lookup is allowed, the exam stops rewarding "can you retrieve it" and starts rewarding "can you use it" — which is usually what you wanted to certify anyway. The International Center for Academic Integrity has been making a version of this argument for years.

Design is a layer, not a replacement

To be clear, assessment design does not retire the other controls. A funded, organised cheat will still try to outsource the whole thing to a hired expert, and that is where delivery integrity and analytics carry the load — capturing an honest picture with something like OroLink, and catching coordinated behaviour after the fact. But of all the layers, question design is the one you fully control, it costs nothing to deploy, and it quietly makes your exam better. Start there.