clearTimeout works only if you saved "timeout id" returned by setTimeout, i.e:
var timer = setTimeout(foo, delay);
...
clearTimeout(timer); // works;
setTimeout(bar, delay);
...
// to cancel previous timer, we must use a "hack" (as no reference is saved, look at EDIT below)
but in any case, you should NEVER rely only on client-side (javascript) check, server-side check is a MUST (and client-side is nice to have, in addition to that).
On server-side:
When you serve a question you simply save the timestamp somewhere (in a session variable, for example), then when you receive answer you compare current timestamp with the one saved when that question was served and make sure that user has not spent more time than allowed to answer the question. This way, even if he/she finds a way to cheat (or simply if he/she has javascript turned off) you will be sure that he/she doesn't spend more time per question than allowed.
EDIT:
As noted in comments on this answer, it is possible to cancel timeout/interval/animationframe if we do not know exact timer id, by canceling all of them in a loop. This is possible since all major browsers implement timer ids as consecutive integer numbers.
I call this workaround a hack since timerID value (returned by setTimeout/setInterval) is not defined in any specification I could find. Currently, all browsers (as it seems, haven't checked them all) use consecutive numbering scheme for timer ids. And, this is not something we can rely on as it is not standardized feature.
Anyway, what is important in my answer is that this SHOULD NOT be done in JavaScript only. Ever.