As Marcus said, there were several MoodleMoot talks this year about large-scale exams, and they are more likely to be useful than my one from years ago. This si a good one
It does seem to be the way the users will plan things without thinking it through (or, more importantly, askign the people know the relevant information.) This is at least in part a result of our own success. If the system always seems to run relably, people don't even think it might not cope with what is thrown at it, and then you end up in a situation like this, which is not good.
It seems that the only baseline you have is your current use. You can get something from that. If you do a query like:
SELECT DATE_TRUNC('minute', TO_TIMESTAMP(timecreated)) AS minute, COUNT(1) num_pages
WHERE timecreated > 1609459200
GROUP BY minute
ORDER BY num_pages DESC
(That works in Postgres
. It migth need some tweaking for MySQL
.) That will cound the number of pages requested in your Moodle site each minute this year, and show you the top 100 of them. If you also have CPU and other performance monitoring of your server (e.g. using a tool like Nagios), then it is really great to combine the two. If you can see that the time you server was handling 2000 requests in one minute, the CPLU load was only 50%, then that is probably a safe level.
You could also add "AND component = 'mod_quiz'" to the WHERE clause, to see the most quiz-related load your system has handled.
Once you have that sort of base-line, you can start to do some back of the envelope calculations: 400 students attempting a quiz. Lets assume they only move to the next page every minute or so, if your system can handle 500 req per second or more, you might be OK. (But really, you would probably want to see a much bigger margin for error than that.)
Anyway, that is the best advice I can give to try to quantify the risks given what you have.