[eluser]Nick Husher[/eluser]
You can do the keep-session-alive part without javascript by using a hidden iframe set to autorefresh every 30 seconds or so.
Code:
<meta http-equiv="refresh" content="30" />
Put that in the view that's loaded into an iFrame (height: 0px width: 0px) and it should hit the same page every 30 seconds as long as the page is alive.
To answer your second question, if the session maintainer mechanism (whatever means you choose, ajax or iframe) doesn't check in after CHECK_IN_DURATION * 2 or whatever, kill their session. Make sure that it does it on both sides by alerting the user that their connection with the central exam server has been compromised and an action item to reestablish that connection.
Really, the only things your interested in is the start time and exam duration, right? Any time a set of answers is submitted to the server, you check to see if the current time is before the start_time + exam_duration.