An attacker is using nmap to do a ping sweep and a port scanning in a subnet of 254 addresses. In which order should he perform these steps?

Performing both steps against all hosts regardless of order wastes resources by port scanning addresses that are not alive.

Port scanning before a ping sweep means scanning potentially dead hosts, which is inefficient and generates unnecessary traffic.

Performing a ping sweep first narrows the target list to only live hosts, which significantly reduces the time and noise generated by the subsequent port scan. Port scanning all 254 addresses when many may be down wastes time and increases detection risk. Scanning only confirmed live hosts is the standard efficient reconnaissance workflow.

A port scan alone against all 254 addresses is slower than first filtering live hosts, and may miss hosts blocking port probes but responding to ICMP.