In a Prime+Probe attack, which step allows the attacker to determine which cache sets the victim accessed?