I'm developing an application that should provide an environment where the following functions are performed:

Administrator
- Register questions
- Edit user
- Viewing Answers - View evidence
- Entered note

User
- If you register
- Fills proof

In this environment the time will be timed the basis of the time of start of the race that will be related to the time filled by the administrator in the evidence register. I thought of validating the time by jQuery just inserting in the database the initial time of the test and comparing regardless of whether the user closed or not the browser. Since I will work with ajax, I will not worry about the user disabling or not the javascript. Each question will be on a screen that will be made available via ajax and if it closes the browser and reopens, it will return to the one that stopped (without bringing what it filled in).

I created the following domains:

Student

public class Bolsa_Aluno
    {
        public int ID { get; set; }

        [Required(ErrorMessage = "Nome deve ser preenchido")]
        public string Nome { get; set; }

        [Required(ErrorMessage = "Email deve ser preenchido")]
        [RegularExpression(@"^([a-zA-Z0-9_\-\.]+)@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.)|(([a-zA-Z0-9\-]+\.)+))([a-zA-Z]{2,4}|[0-9]{1,3})(\]?)$", ErrorMessage = "E-mail inválido")]
        public string Email { get; set; }

        [Required(ErrorMessage = "CPF deve ser preenchido")]
        [StringLength(11, ErrorMessage = "Digite apenas 11 números")]
        public string CPF { get; set; }

        [Required(ErrorMessage = "Telefone deve ser preenchido")]
        [StringLength(15, ErrorMessage = "Digite no máximo 15 caracteres")]
        public string Telefone { get; set; }

        public string Curso { get; set; }

        public virtual int AlunoProvaID { get; set; }
        public virtual Bolsa_AlunoProva AlunoProva { get; set; }
    }

StudentProva

public class Bolsa_AlunoProva
    {
        public int ID { get; set; }
        public int Nota { get; set; }
        public DateTime DataInicial { get; set; }
        public DateTime DataFinal { get; set; }

        public virtual int AlunoID { get; set; }
        public virtual Bolsa_Aluno Aluno { get; set; }

        public virtual int ProvaID { get; set; }
        public virtual Bolsa_Prova Prova { get; set; }

        public virtual ICollection<Bolsa_AlunoResposta> AlunoResposta { get; set; }
    }

StudentAnswer

public class Bolsa_AlunoResposta
    {
        public int ID { get; set; }
        public string Resposta { get; set; }

        public virtual int AlunoProvaID { get; set; }
        public virtual Bolsa_AlunoProva AlunoProva { get; set; }

        public virtual ICollection<Bolsa_Pergunta> Pergunta { get; set; }
    }

Question

public class Bolsa_Pergunta
    {
        public int ID { get; set; }

        [Required(ErrorMessage = "Pergunta deve ser preenchido")]
        public string Pergunta { get; set; }

        public virtual int AlunoProvaID { get; set; }
        public virtual Bolsa_AlunoProva AlunoProva { get; set; }

        public virtual int AlunoRespostaID { get; set; }
        public virtual Bolsa_AlunoResposta AlunoResposta { get; set; }
    }

Proof

public class Bolsa_Prova
    {
        public int ID { get; set; }

        [Required(ErrorMessage = "Tempo deve ser preenchido em minutos")]
        public int Tempo { get; set; }

        [Required(ErrorMessage = "Quantidade de Perguntas deve ser preenchido")]
        public int QuantidadePerguntas { get; set; }

        public string Nome { get; set; }
        public string Bandeira { get; set; }

        public virtual ICollection<Bolsa_Pergunta> Pergunta { get; set; }
    }

My question is the following. Is this the best validation and storage practice telling you that I do not have to worry too much about security?

Is it a bad practice to save each response individually in the database to "keep the session" in case the user closes the browser?

When I run migration (working with code-first), I came across the following relationship error:

  

Unable to determine the main end of an association between the   types 'Domain.Provider' and 'Domain.Provider'. The   principal of this association must be explicitly configured using   either the relationship fluent API or data annotations.

Would it be correct to apply the [Required] tag to Bolsa_AlunoProva as a solution in the public virtual Bolsa_Prova Prova { get; set; } ?