add doc: advanced zone with security groups