When using the timer in the browser there is no way to verify that it is running as expected. User can disable javascript and get around your restrictions; heck they can even change your javascript. So relying solely on javascript is not an option.
The best solution is to validate postbacks on server side. You can use javascript on Client side to inform the user so that they are aware of how much time is left and server side to verify they have not gone over the time limit. If synchronization is required, then you can have the javscript ping back every so often to resynch the time.
Expanded Answer
The time of the start of the test should be on the server side. Whenever the user clicks begin test or other start buttton to begin their test. The server should note the current time - perhaps in a session or even in database.
The user should then be informed of the time remaining via javascript and expected end time. These are then updated whenever the user submits a question or perform another postback to the server.
The end time will be the fuzzy part. If the javascript does it's job correctly; you can inform the user their test has ended through this (or window.href etc). If the javascript is not worked; then the user will receive their notification whenever they next attempt to submit something to the server.
Either way, the user should clearly be informed that this is the expected end time, and how much time they have remaining on each page load.