Conducting exams in which a computer (but no internet) is available In my institution, we have various lab exams in which part of the exam is completing a programming task, and a computer is available to each student for this purpose. 

There are there various ways to submit the exercise then: for instance, files can be submitted through a dedicated web service (elegant and easy to use, but it needs to be coded by hand and the grading is more complicated if there is also a pen-and-paper part to match), or the student is asked to copy the program/function on paper (tedious, but simple to implement).

Clearly, in this exam format it would be desirable to limit access to the internet, to reduce the possibilities to cheat and (in exams where this is forbidden) look up external information. This task seems complicated because 


some network access is necessary for the computer infrastructure to work (for instance, network logon) 
some programs may require additional network access: for instance, Matlab campus installations usually require access to a "license server" installed on a university-controlled machine 
the exam itself may also require the network somehow: for instance, to download test files, or for the interface to submit exercises mentioned above.


My experience is that IT administrators are reluctant to provide something like this, and that the result is quite error-prone: limiting the network access is tricky to do, it often fails and usually it leaves room for loopholes (for instance, the students can still chat to each other with netcat). Ideally, a fully locked-down "exam mode" would also have some more features, like forbidding access to USB sticks, but this also must be implemented by hand.

With this premise, my questions are:


Is this way of conducting exams common also in other institutions/university systems/nations? Is it inherently bad, or does it have some pitfalls that I have overlooked?
Is there an easy way to implement a "locked-down exam mode" on a computer (with either of Windows, Mac, and Linux, or rather, possibly, all of them) by using standard products? Are they effective, or are they easy to circumvent? Or does everyone roll their own hand-crafted solution? Some operating systems ofter "guest modes", which are a good starting point, but some more configuration is needed.
Is it normal for us teachers to ask the IT service to hack together something to implement this mode? Are there any technology suggestions that we can give them to make it more effective?
Should I (as an instructor) expect this "locked down exam mode", once implemented, to work seamlessly out-of-the-box, or is it something that is inherently clunky and error-prone?
My university in the UK provides such "locked down exam mode". Students log in with special "exam accounts", while their normal accounts are disabled for the time being. Exam accounts have limited access to network, permitting access to the University network (including submission servers, licensing servers, and other necessary infrastructure), and restricting access to anything else. This has been working well for the last 10-ish years at least, and I have not heard any major complaints from IT staff about it. For comparison, the same IT staff found it difficult to install TexLive on all university computers and were reluctant to perform this task.