What are some of the methods that can be used to avoid a page being cached by the browser?

I have a user that is trying to view the questions of an online exam. During the exam they select 1 of 4 answers and click "Answer". For this user it seems to load the same page/question over and over again, where as it should advance to a new question after every question answered. My guess is that it's caching, but it doesn't seem to be browser caching as they have tried both Internet Explorer and Firefox. They are using satellite internet, so my guess is that there is some other caching on their network/router.

Here are the headers that are sent from the server.

HTTP/1.1 200 OK 
Date: Tue, 03 Mar 2009 05:52:38 GMT 
Server: Apache/2.2.8 (Unix) 
X-Powered-By: PHP/5.2.6 
Set-Cookie: PHPSESSID=[...]; path=/ 
Expires: Thu, 19 Nov 1981 08:52:00 GMT 
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 
Pragma: no-cache 
Connection: close 
Content-Type: text/html; charset=UTF-8

I have had the user reset their browser settings completely, but it hasn't made a difference. I have added a timestamp to the GET query/string of the page, such as:

/path/question.php?exam_id=2323&user_exam_id=2334&timestamp=1236063834

What other methods can I use to force the user's computer to refresh the page on every page load?

The server is running Apache, PHP, MySQL.

From stackoverflow

• I use:

  Cache-Control: no-cache
  Pragma: no-cache
  Expires: Thu, 01 Jan 1970 00:00:00 GMT

  Edit: ... and never had a problem. It seems that some very strong caching layer is between the user and your application.

• See w3.org's spec on Cache-Control, you can only have one value for Cache-Control. You want no-cache, I assume.

  EDIT: Either that's an old spec, or this is different in de-facto. Try

  Cache-Control: no-cache, no-store
  Pragma: no-cache
  Expires: -1
  

  (from here)

• Set-Cookie: PHPSESSID=[...]; path=/

  Is it possible that they have a some sort of cookie control running?

  If so PHP can be set to propagate a session ID through the URL.

  Darryl Hein : How would that affect caching? The session ID is the same for every page within the current session.

  bobince : I don't think it's anything to do with cacheing. You've already got every cachebuster known to man in those headers; smells far more like your application doesn't work without cookies.

  David L Morris : Darryl, I think that depends on how you manage the session. You can, optionally, keep that in local memory on the server and not use a cookie. Remembering that the client is (by default) completely stateless.