An attacker is using nmap to do a ping sweep and a port scanning in...

The sequence does not matter. Both steps have to be performed against all hosts.

First the port scan to identify interesting services and then the ping sweep to find hosts responding to icmp echo requests.

First the ping sweep to identify live hosts and then the port scan on the live hosts. This way he saves time.

The port scan alone is adequate. This way he saves time.