When attempting to change a root account's password in a UNIX system, the CPM (Central Policy Manager) will first log in with the associated logon account and then use the SU (substitute user) command to switch to the root account. This is a standard procedure to ensure secure access and management of the root account, leveraging the existing logon account credentials stored in the Vault. Therefore, the correct option is that the CPM will log in first with the logon account, then run the SU command to log in as root using the password in the Vault.