Krdytkyu

As far as security zones are concerned, we apply policies to it to control the transit traffic.
And we also apply host-inbound-traffic to a zone or interfaces.
If we have both of the above configurations, why there is junos-host zone to prevent the traffic destined to the device itself as "host-inbound-traffic" also does the same thing.
Please help to correct me if im wrong somewhere or am missing something.

This whole concept of junos-host zone and security zones along with policies is confusing.

Junos-host zone can be used to add an additional check for traffic
destined to SRX. If you don't configure any security policy to-zone
junos-host, the traffic/packet will be validated based on
host-inbound-traffic configured under security zones. If you
configure security policy to-zone junos-host, that policy check will
be done additionaly to host-inbound-traffic/services specified under
zones.

For example, if you allow SSH/Telnet/OSPF under interface
ge-0/0/0.0, but configure a security policy to-zone junos-host
allowing SSH, then Telnet/OSPF wont work. Only SSH will work.

More to read:
Link-1
Link-2

Inbound packet will pass in this order:

1. Input interface filter, if set


2. Zone host-inbound-traffic
   


3. Zone-to-Zone policy

If traffic passed on 1 step, it can be still denied on 2 or 3.
Assume:

1. No interface filter applied


2. 
   host-inbound-traffic set to system-services ssh
   


3. Policy from zone zone1 to-zone junos-host allows only ICMP ping

As result, not ICMP ping, not SSH will be allowed. ICMP ping will be dropped on step 2; SSH will be dropped on step 3.