Which command line switch would be used in NMAP to perform operating system detection?

-OS is not a valid Nmap flag; Nmap switches are case-sensitive and no combined -OS flag exists in the tool.

-sO performs an IP protocol scan to enumerate open IP protocols on the target, which is unrelated to OS fingerprinting.

-sP (replaced by -sn in modern Nmap) performs a ping-only host discovery scan without port scanning or OS detection.

The -O flag instructs Nmap to perform active OS fingerprinting by sending a series of specially crafted probes and comparing the responses against its internal OS signature database. Differences in TCP/IP stack implementation details - such as window size, TTL, and response to unusual flags - allow Nmap to infer the target operating system. This is distinct from port scanning and requires at least one open and one closed port to function accurately.