Appendix 1: Technical Arrangements for the Exam Room

The key technical threats have been identified, and preparedness measures have been put in place as follows:

• Power outages are prepared for at several levels. Key systems are battery‑backed, and the use of a battery is also recommended for candidates’ computers. The system automatically saves the candidates’ responses and files, ensuring that no responses are lost if a computer shuts down. (See chapter 2.3, Securing the electricity supply during a power outage, and the General Regulations and Guidelines of the Matriculation Examination Board, Appendix 2: Guidelines concerning the candidate’s computer.)
• Individual computer problems are prepared for by providing backup computers, the arrangement of which is the responsibility of the general upper secondary school (see chapter 5.1).
• Data communication problems affecting individual candidates are prepared for by arranging reserve workstations in the exam room (see the General Regulations and Guidelines, subchapter 2.3.3, Exam rooms). The reserve workstations must be equipped in the same way as the candidates’ assigned workstations.
• Failures of the exam room server are prepared for by using a server cluster. The cluster stores all data on each server separately on every server in the cluster.

The power requirement of a candidate’s computer is typically approximately 15–60 W (65–260 mA). Consequently, even a large number of devices requires a relatively small amount of electrical power from the electricity supply.

The cross-connect cabinet serving the data communication connections of the test system, i.e. the examination network, together with its active equipment, constitutes the largest single load of the system. Typically, the power requirement of even a large cross-connect cabinet is less than 3.6 kW (16 A, 230 V). All of the above‑mentioned devices connected to the electricity supply are plug‑connected, using either earthed or unearthed plugs.

The room must have enough standard power sockets for the equipment.

Each candidate must have access to one power socket. As the equipment is connected to the electricity supply by non‑professionals, it is recommended that the power sockets be earthed and protected by residual current devices (RCDs). It is recommended that the candidates’ computer chargers be connected to the power supply before the start of the test to avoid disrupting the test if any equipment is faulty.

Socket circuits are normally protected by 16A fuses or miniature circuit breakers. New installations are additionally protected by 30 mA residual current devices. The active equipment of the examination network must be connected to dedicated power sockets, separate from other equipment loads.

In many exam rooms, the electricity distribution has to be implemented as a temporary installation that can be easily and quickly dismantled. For this reason, the electricity supply is arranged using a temporary distribution network consisting of several portable power distribution boards and extension cords.

Even large temporary networks can be implemented, for example, using power distribution boards connected to a three‑phase power socket (16 A, 32 A or 63 A) and chained together. The power distribution boards can be connected in series and are equipped with multiple power sockets protected by residual current devices.

When installing temporary final circuits, excessively long cable runs and the daisy-chaining of extension leads should be avoided. No more than eight computers should be connected to a single fixed 16 A single-phase socket to ensure protective devices operate within their limits and to enable quick identification of faults during the test.

If a residual current device or circuit breaker operates at a single-phase socket on a power distribution board, the invigilator may clear the fault if they have been instructed in the task.

Electrical and data communication equipment and cables must be positioned to minimise situations in which candidates or invigilators have to step over cables.

Those carrying out the temporary electrical installation are responsible for how it is implemented. Where necessary, a qualified electrical professional must be engaged to verify that protective devices function properly by carrying out the required tests and measurements.

The operation of the exam room servers during the test situation is secured by an uninterrupted power supply. If the servers do not have their own internal batteries, a UPS device must be used to secure the electricity supply. The batteries must be dimensioned to ensure a backup operating time of at least 15 minutes for the servers.

If a particular examination location has a higher than usual risk of power outages, the electricity supply may be secured using a portable backup power generator.

It is the candidates’ responsibility to ensure that their computers have sufficient battery operating time. The computer should be able to operate on battery power for at least 15 minutes after the electricity supply is interrupted.

The general upper secondary school may also secure the electricity supply for the candidates’ computers at its discretion.

In the exam room, space is reserved for the exam room servers, and switches are used to extend the network to each candidate’s workstation.

The examination network may also cover several separate exam rooms located in the same building.

A candidate may be entitled to a separate exam room based on a decision on special arrangements. There are two options for arranging data communications for separate exam rooms:

• Separate examination networks are built for the separate rooms, each with its own exam room server and backup server.
• Candidates’ computers in separate rooms are connected via Ethernet cables to the main exam room’s examination network.

If the examination network is routed via the building’s fixed cabling and switches, it must be ensured that the examination network is not connected to the building’s other networks. This can be achieved either by configuring a dedicated VLAN for the examination network on the existing switches, or by routing the examination network through a dedicated switch located in a communications room or cabinet.

The general upper secondary school must have backup equipment available to ensure that any failure of a single network component during the test can be remedied by replacing it with a functioning one within 60 minutes of the moment the fault has been detected. Schools may share backup equipment.

The switches used in the examination network do not need to be managed. If managed switches are used, it must be ensured that they do not operate as DHCP servers.

The data transmission speed of the network must be 1,000 Mbit/s (1 Gbit/s) throughout the network. Shielded network cables (STP) are recommended when network cables are bundled tightly together, for example using cable trays or cable ties. Otherwise, unshielded cable (UTP) is sufficient. At least Category 5e cabling must be used in the network.

The devices of the examination network must be kept under supervision or in locked premises. During the test, the devices must be under the supervision of the invigilators. At other times, the devices must be stored in locked cross‑connect rooms or cabinets or other locked rooms or cabinets so that no unauthorised persons can access them. If the devices are stored in the exam room, the room must be locked after the examination network has been set up and remain locked until the start of the test.

The use of a wireless WLAN network as part of the examination network is permitted only if the general upper secondary school has obtained permission from the Board. In the same exam room, there may also be an examination network using Ethernet, which some candidates use.

Before applying for permission, the general upper secondary school must itself assess the exam rooms in which a wireless examination network is intended to be used. For the purposes of the assessment and the application for permission, the Board has issued separate regulations and instructions (see General Regulations and Instructions of the Matriculation Examination Board, Appendix 3: Regulation on the use of a wireless examination network in the Matriculation Examination).

The same principles that apply to the construction of the Ethernet network and the storage of equipment also apply to the WLAN network. The equipment must be kept either in locked or supervised premises. WLAN network equipment may also be placed out of reach of unauthorised persons by installing it sufficiently high, in which case placement in locked premises is not required. The requirement concerning backup equipment for the Ethernet network also applies to the WLAN network, with the exception of a possible controller.

Outgoing traffic from the server to the internet must not be restricted, for example by access control lists. Incoming connections from the internet to the server must not be permitted. Detailed information on the traffic used by the server can be found in the server testing instructions.

A server cluster consisting of 2 to 5 servers must be used in the Matriculation Examination. A single server may serve a maximum of 5, 75 or 150 candidates, depending on the server’s capacity. All servers in the server cluster must be of equal capacity.

Sizing and placement of the server cluster

The number and capacity of servers in the server cluster are determined by the number of candidates in the examination network. The cluster must always include at least one backup server in case one of the servers in the cluster fails during the test. The table below provides examples of different numbers of candidates and the corresponding number of servers required. The figures include the backup server.

If a single examination network covers several exam rooms, the servers must be placed in different parts of the network. Candidates working in different parts of the network should be directed, where appropriate, to the server closest to them within the network.

Server requirements for all performance classes

• The server has a 64-bit x86 processor with at least four cores (for example, a quad-core processor or a dual-core processor with hyper-threading). 
• A Linux operating system is installed on the servers using the Matriculation Examination Board’s automatic installation. 
• The server has an Ethernet interface with a data transfer rate of at least 1 Gbit/s. 
• In addition to the Ethernet interface mentioned above, the server has a second network interface that is connected to the internet.
• The server is kept in locked premises so that only trusted persons have access to it. 
• The computer does not have user accounts or other access rights for anyone other than persons involved in organising the Matriculation Examination. During the examination, the general upper secondary school has a person present who knows the password of an account with administrator privileges on the computer. 
• Only software that does not compromise the security of the computer is installed on the server.

The server must be battery-backed. The battery backup may be provided by an external UPS or be internal to the device (e.g. a laptop). The server must be capable of operating on battery power for at least the backup operating time specified in the Board’s instructions.

Requirements for a server serving a maximum of 5 candidates

• The server has at least 8 GB of RAM, from which the graphics adapter may use the required portion. 
• The server’s processor performance exceeds 10,000 points in the benchmark test (https://www.cpubenchmark.net/).
• The server has at least 256 GB of storage, of which the MEB Linux installation uses the required portion.

Requirements for a server serving a maximum of 75 candidates

• The server has at least 16 GB of RAM, from which the graphics adapter may use the required portion. 
• The server’s processor performance exceeds 20,000 points in the benchmark test (https://www.cpubenchmark.net/).  
• The server has at least 1 TB of storage, of which the MEB Linux installation uses the required portion.

Requirements for a server serving a maximum of 150 candidates

• The server has at least 32 GB of RAM, from which the graphics adapter may use the required portion. 
• The server’s processor performance exceeds 35,000 points in the benchmark test (https://www.cpubenchmark.net/).  
• The server has at least 1 TB of storage, of which the MEB Linux installation uses the required portion.

Requirements for a server serving more than 150 candidates

If a general upper secondary school requires a server capable of serving more than 150 candidates for test arrangements, the necessary arrangements must be agreed with the Board in advance.

Requirements for a server cluster consisting of more than five servers

If a general upper secondary school requires a server cluster consisting of more than five servers for test arrangements, the necessary arrangements must be agreed with the Board in advance.

During the test, invigilators must have access to a computer on which the invigilator view is open. Invigilators require the invigilator view to read and complete the electronic record and to obtain information on any technical problems with the candidates’ computers.

The invigilator view can be opened on any computer that can be connected to the examination network and that has an up‑to‑date web browser. Instructions for logging in to the invigilator view are available in the Naksu 2 application on the exam room server.

Each server in the server cluster has an invigilator view; however, routine invigilation tasks (for example, reading and completing the record and monitoring the status of candidates) can be carried out from the invigilator view opened via any server in the cluster.

Candidates’ computers are connected to the examination network either using Ethernet cables or via a wireless connection. The network settings of the candidate’s computer are obtained from the exam room servers using the DHCP protocol.

The technical requirements for candidates’ computers are described in the instructions concerning the candidate’s computer, which are appended to the Board’s General Regulations and Guidelines. The candidate’s computer, together with any peripheral devices, must receive all the power it requires from a single power outlet.

Screen privacy filters may be used on candidates’ computers, provided that their use does not prevent invigilators from seeing the candidates’ screens.

Candidates’ computers must have either the Abitti 2 candidate application installed, or the computer must be booted from an Abitti 2 candidate drive.

The Abitti 2 candidate application includes a locked browser that prevents the candidate from unintentionally accessing materials outside the test. The browser opens a connection only to the exam room server. The candidate application also includes technical monitoring, which monitors the operation of the computer during the test. The data collected by the technical monitoring is transmitted to the Board and is used to detect possible examination misconduct. Technical monitoring starts when the candidate application establishes a connection to the server and ends when the candidate application is closed.

In addition to the candidate application, the Abitti 2 candidate drive includes a Linux operating system. The candidate’s computer can be booted from an Abitti 2 candidate drive, which may be written either to a USB flash drive or to the computer’s internal drive. In this case, the operating system normally used on the computer is not used during the test.

One month before the first examination day, the Board informs general upper secondary schools of which Abitti 2 candidate application versions will be used in each examination round.

Schools must forward this information to the candidates participating in the examination so that they can install the correct version of the candidate application on the computers they use.

If candidates use the Abitti 2 candidate drive, the general upper secondary school must write the required disk images to USB flash drives it has acquired. Candidates must inform the school at least one month before the first examination day if they require an Abitti 2 candidate drive.

The general upper secondary school must have one backup computer meeting the requirements for a candidate’s computer, including headphones, for every ten candidates at the test venue. However, each test venue must have at least one backup computer. For example, a test venue with 100 candidates requires 10 backup computers, whereas a test venue with 5 candidates must have 1 backup computer. These backup computers are intended to replace candidates’ computers that fail during the test.

The school may assess that fewer backup computers are required than described above, for example if most candidates use devices provided by the school and their compatibility with the test system has been tested. In such cases, the school may, at its discretion, reduce the number of backup computers to 5–10% of the number of candidates.

The school must ensure that the backup computers have one of the announced Abitti 2 candidate applications available. Invigilators must be able to boot the backup computers from a USB flash drive. Instructions for starting the candidate application may be attached to the backup computers. The school must also ensure that the backup computers can be connected to the examination network of the test venue.

Visually impaired candidates who have been granted special arrangements by the Board use a computer on which the software specified in the decision on special arrangements is installed for the digital Matriculation Examination.

This may, for example, be the candidate’s own computer. This computer is referred to as a separate computer.

A separate computer is also used by candidates who, on the basis of a decision on special arrangements, are entitled to assisted printing and scanning.

Before the test, the general upper secondary school must ensure that the computer does not contain any unnecessary files or software and that spell checking has been disabled in the word processing software. Any network connection outside the examination network is strictly prohibited.

As a rule, the candidate takes the test in a separate room to avoid disturbing other candidates through communication between the candidate, the invigilator and any assistant.

The separate computer is connected to the examination network in the same way as other candidates’ computers. Instead of using the candidate application, the candidate connects to the exam room server using a web browser.

Detailed instructions on the use of a separate computer are published on the Board’s website.