An attacker is using nmap to do a ping sweep and a port scanning in a subnet of 254 addresses.
In which order should he perform these steps?

A.
The sequence does not matter. Both steps have to be performed against all hosts.

B.
First the port scan to identify interesting services and then the ping sweep to find hosts responding to icmp
echo requests.

C.
First the ping sweep to identify live hosts and then the port scan on the live hosts. This way he saves time.

D.
The port scan alone is adequate. This way he saves time.