You cannot successfully disable refresh in a cross-browser manner. And you shouldn't. See
InterfaceDesignersRule1.
What
you should do is to track the state of the exam and the timer in the session (most likely employing Ajax to send the state to the server periodically). That way, when the user refreshes, you can detect that they were in the middle of an exam, and restore the state at the time of the refresh.