Is your question bank safe on your online test platform?
Partly. A good test platform can curb staff exports, practice-mode harvesting and forwarded solutions PDFs, but not a photo from a second phone. Keep unseen questions private; treat seen ones as public.
On this page 8 sections
- A question bank leaks one question at a time
- The ways questions get out of a test platform
- Shuffling and pools protect a test, not the bank
- Keep unused questions out of practice mode
- Who on your team can export the whole bank?
- Screenshot blocking on Android, iPhone and laptops
- Where to start if your bank is already online
- Frequently asked questions
Partly. A decent test platform can shut the cheap leaks: a staff login exporting the whole bank, or a solutions PDF forwarded with no name on it. No platform can stop a student photographing a question with a second phone. So the realistic aim is to keep unseen questions private, and to treat every question students have seen as already public.
A question bank leaks one question at a time
When a lecture leaks, it leaves as one file you can usually find. A question bank leaks in fragments. A screenshot of question 37 turns up in a doubt group. The solutions PDF for one mock gets forwarded. A faculty member who left last year still has the reasoning folder on a laptop. None of these looks serious on its own, so nobody acts until a channel is selling a full set of your mocks with solutions.
Say, as an example, an SSC institute in Delhi has 18,000 questions built over six years by four faculty members, each with a worked solution and a shortcut. Most of the value sits in two places. One is the questions no student has seen yet, which make your next ranked mock worth paying for. The other is the solutions, which carry your faculty's method. Spend your protection effort on unused questions and on solutions, and much less on the rest.
The ways questions get out of a test platform
Read the last column first. It shows what stays exposed once every control is on.
| Route | What leaves | Control that helps | Where it stops working |
|---|---|---|---|
| Screenshots and photos during a test | Single questions, posted to groups while the test is running | Screenshot blocking in the app, the student's ID on the test screen, solutions hidden until the window closes | A second phone's camera; a retyped question carries no ID |
| Solutions PDFs | A whole mock with answers and explanations | Solutions inside the app after the last slot; the student's name and phone number on every PDF page | A student who retypes the solutions |
| Staff and freelancer copies | Whole subjects, sometimes the entire bank | Permissions by role, export rights for one or two people, an export log, access removed on the last day | Files already on personal laptops and Drive folders before any of this was set up |
| Practice mode harvesting | Every question and solution one account can open | Solutions only after an attempt, limits on shared logins, alerts on unusual volume | A patient student with a paid account copying by hand |
| Doubt posts | Single questions posted in public groups for help | A doubt section in the app that faculty answer the same day | Students who prefer a public group anyway |
The staff route is the one owners underestimate, because the people involved are trusted. In most institutes the bank started as Word files that faculty, a typist and a reviewer passed around on WhatsApp, and those copies still exist. A former employee who joins a rival institute or starts a YouTube channel doesn't need to hack anything.
Whole papers leaking before test day are a separate problem, covered in our guide on preventing question paper and test series leaks.
Shuffling and pools protect a test, not the bank
Shuffling question order and answer options is cheap, and worth switching on for nearly every test. It breaks the crudest copying during a live test, where one student messages "Q14 is C" to a group. Lock the option order on questions whose options refer to each other, such as "Both (a) and (c)" or "All of the above". Otherwise the shuffle turns a correct question into a wrong one, and you'll hear about it from toppers first.
Pools go further. Instead of one fixed paper, each student gets questions drawn at random from a larger set, tagged by topic and difficulty. As an example, take a 45-question chemistry sectional, the same length as the Chemistry section in NEET (UG) 2026, drawn from a pool of 135. Any two students share about 15 questions on average. A morning-slot screenshot then helps an evening-slot friend far less.
From the bank's side, each student sees a third of the pool. Five students who share their papers have seen about 87% of the questions, and ten have seen about 98%. Ten students in one Telegram group can make the whole pool public after a single sitting.
Pools do help with tracing. Say a Telegram post carries five questions from that sectional, retyped from one student's paper. In a batch of 2,000, only about seven students would have drawn all five, which is a short list to check.
On ranked tests, pools cost you fairness. If one student's draw carries more of the hard questions, the all-India rank means less. For ranked mocks we would give everyone the same paper, shuffled, inside a fixed window, and keep pools for sectional and practice tests.
Keep unused questions out of practice mode
A bank is safer when it ages on purpose, so that practice mode only ever sees older questions. A new question starts private, visible to its author and a reviewer, and waits for the next ranked mock. During that test's window it appears only inside the test, with the solution hidden. When the last slot closes, the solution opens in the app for students who sat the test, and the question moves to the used set. That set feeds sectionals, topic practice and revision quizzes. If one turns up on Telegram, retire it from graded tests. From then on it can go anywhere, including your free daily quiz on YouTube.
Practice mode is where harvesting happens. One paid login, sometimes shared by a group, can open every practice test and read every solution without answering anything. Showing a solution only after the student submits an answer is better teaching, and it makes a harvester click through each question instead of scrolling a list. That slows copying without stopping it, so add alerts on unusual volume, with the threshold set from what your real students do. A serious aspirant in the last month before SSC CGL Tier 1 might take eight sectionals in a day, and you don't want to flag her.
If students need printable solutions, put the student's name and phone number on every page, so the file itself is risky to forward. Our guide to protecting PDF notes and study material covers the files you do hand out.
Who on your team can export the whole bank?
On many platforms, export is one button for anyone with admin rights. Open your user list today and count how many people could download every question, with solutions, in one file. If that list includes anyone who has left, fix that first.
A sensible setup lets faculty write and edit questions in their own subject, lets a reviewer approve them, and gives export rights to one or two people. Log every export with the name, the date and the number of questions. Remove access on a person's last working day, not at the end of the month. Typists who enter questions from handwritten sheets need to add questions, not download them.
The platform's controls mean little if the master Word files sit in a Drive folder open to anyone with the link. Move the masters to one place and stop sending drafts over personal WhatsApp.
Ownership matters when a faculty member leaves with "their" questions. Under section 17(c) of the Copyright Act, 1957, work an employee makes in the course of employment belongs to the employer, unless they agreed otherwise. A freelance setter paid per question is not an employee, so the setter owns what they write until they assign it. The same can be true of a star teacher paid per lecture or on a revenue share, so check the terms each faculty member is on.
Section 19 makes an assignment valid only if it is in writing and signed. It should name the work, the rights, the duration and the territory, and if no period is stated, the law reads it as five years. So an assignment signed in 2021 that names no period runs out during 2026. This is general information, not legal advice.
Screenshot blocking on Android, iPhone and laptops
On Android, a test app can mark its screen as secure with the FLAG_SECURE setting. The system then refuses the screenshot or saves a black image, and screen recordings come out black too. Our explainer covers what FLAG_SECURE blocks and what it can't stop.
On an iPhone, an ordinary app cannot block a screenshot. iOS tells the app once one has been taken, and it can tell when the screen is being recorded or mirrored. The app can log the event against that attempt or end the test, but the image already exists. See what iOS screen recording detection can't stop.
In a laptop browser, a web page can't stop a screenshot at all. Desktop apps on Windows and Mac can ask the system to keep their window out of captures, with mixed reliability. So run ranked mocks in the app, and keep browser tests for practice on used questions.
None of this stops a second phone. Showing the student's ID on every question screen means the photo carries a name. A student can crop it out, so treat it as a deterrent rather than proof. Bypassing screenshot protection to copy your questions can also be an offence under section 65A of the Copyright Act, with up to two years' imprisonment and a fine.
Where to start if your bank is already online
This order gets the most protection for the least faculty time:
- Cut export rights to one or two people, and remove everyone who has left.
- Find the copies outside the platform, on Drive and old laptops, and close the sharing links.
- Get signed copyright assignments, with the duration stated, from setters and faculty who aren't on your payroll.
- Hide solutions until the last slot closes, and move them from PDFs into the app.
- Turn on shuffling, with option order locked where options refer to each other.
- Move ranked mocks into the app, with screenshot blocking where the device allows it.
- Tag questions by stage, so unused ones never reach practice mode.
Most of that is settings and habits, and none of it needs a particular platform. Upclass Mock Test runs your test series inside apps in your institute's own name, and two VidSafe controls help where settings run out. PDF watermarking marks the solutions you do hand out, and account-sharing prevention makes one paid login harder to pass around a group. See the test series software, or book a demo and bring a file of your own questions.
Frequently asked questions
Can students take screenshots during an online test?
Not in an Android app that marks the test screen as secure. On an iPhone the app only learns of a screenshot after it's taken, and a web page in a browser can neither block nor reliably detect one. A photo from a second phone works everywhere, which is why the student's ID belongs on the test screen.
Do I need separate question bank software?
Not if your test platform already has a proper bank, with topic and difficulty tags, roles for faculty and reviewers, and controlled export. A separate tool means one more copy of every question and one more set of logins to manage. It earns its place when you print papers for offline centres and need a paper generator your test platform lacks.
Is selling or posting a coaching institute's mock test questions illegal?
Yes, selling them is. Questions and worked solutions your faculty write are protected as literary works, so copying and selling them infringes your copyright. Under section 63 of the Copyright Act, knowing infringement is punishable with six months to three years' imprisonment and a fine. One question posted in a group to ask for help is a different case, better handled with a word to the student than a legal notice.
