Rudy,
I think Brian meant Javascript, which is much easier, and different than
Java.
If it's a web based app, you could easily do a settimeout function on the
client using Javascript, the hacker client might disable javascript to get
around that, so you have to send a "Question Generated" time to the page in
some encrypted fashion, and compare the submission time - which of course
someone will bitch about being unfair on a low bandwidth connection, but
that is a limitation of web you'll have to live with.
The second case could be, if it is a windows app. A windows app could be
controlled by the server using a simple remoting like scenario, where the
client becomes the remoting server for a breif call. The server calls a
function to indicate the start of a timecycle, and you might want to
implement checks like above. This could even be done using webservices.
HTH,
--
- Sahil Malik
http://codebetter.com/blogs/sahil.malik/