An attacker is using Nmap to do a ping sweep and a port scanning in a subnet of $254$ addresses.

In which order should he perform these steps?

The sequence does not matter. Both steps need to be performed against all hosts.

First the port scan to identify interesting services and then the ping sweep to find hosts responding to ICMP echo requests.

First the ping sweep to identify live hosts and then the port scan on the live hosts. This way he saves time.

The port scan alone is adequate. This way he saves time.