Precaution for guessing URLs

Hi Guys,
I would like to ask for some direction on my new project.
Small Brief.
I am redesigning our online training centre that will offer a number of courses to purchase online along with tangible products.
Once client has purchased a course, that course becomes available in the client frontend to complete and submit exams.
What I have completed so far tested and works.

Setup ecart and integrated with Data assist to create my shopping cart pages.
Setup registration on checkout.
Setup Security.
Setup order History / details Pages
Setup client Courses Profile page to list only course’s that client has purchased.
Set up link to Courses Profile page only if client has purchased a course because I don’t want anyone who has not purchased a course to gain access to the Course profile page. (For example, if they just register for an account or have purchased a tangible product.)
Phew – All well and good.
Here is where I need some direction please.

Since each course will have different course material, HD Video’s and exams etc.
What will be the best way to separate each course so no one can gain access to the course material unless they have purchased that particular course? I am talking about someone maybe guessing a URL for another course.

Kind Regards

Jonathon