When changing root's password on a UNIX system, the CyberArk Password Manager (CPM) does not log in directly as the root user for security reasons. Instead, it logs in as an associated logon account, which has sufficient privileges. After logging in as the logon account, CPM uses the 'su' command to switch user to the root account. This method ensures a more secure and controlled approach by utilizing a tiered access mechanism. Therefore, the correct process is to log in to the system as the logon account, run the su command to log in as root, and then change root's password.