Which of the following tools can be used for passive OS fingerprinting?

dig is an active DNS query tool that sends DNS requests to a server, which is an active technique, not passive fingerprinting.

nmap performs active host and port scanning by sending crafted probe packets to targets, making it an active - not passive - fingerprinting tool.

ping sends active ICMP Echo Request packets to a target and waits for replies, which is an active probing technique.

tcpdump is a packet capture utility that passively listens to network traffic without injecting any packets of its own. By capturing live traffic and analyzing TCP/IP header fields such as TTL values, window sizes, and TCP options, an analyst can infer the remote operating system without alerting the target.