In which order should he perform these steps?

An attacker is using nmap to do a ping sweep and a port scanning in a subnet of 254 addresses.

In which order should he perform these steps?
A . The sequence does not matter. Both steps have to be performed against all hosts.
B . First the port scan to identify interesting services and then the ping sweep to find hosts responding to icmp echo requests.
C . First the ping sweep to ident fy live hosts and then the ports canon the live hosts. This way he saves time.
D . The port scan alone is adequate. This way he saves time.

Answer: C